AFLAC INC

The following should be read in conjunction with and supplements and amends the risk factors that may affect the Company’s business or operations described under “Risk Factors” in Part I, Item 1A. of the Company's Annual Report on Form 10-K for the year ended December 31, 2024.

The Company experienced a cybersecurity incident in June 2025 which could result in a number of potential outcomes, including, but not limited to, additional costs and expenditures, litigation, regulatory investigations or enforcement actions, or reputational harm, any of which could have an adverse effect on the Company’s financial condition or results of operations.

As part of the June 2025 cybersecurity incident, the Company is aware of the exfiltration of certain data, including claims information, health information, social security numbers and/or other personal information, relating to a substantial number of customers, beneficiaries, employees, agents, and other individuals in the Company’s U.S. business. The Company has incurred certain costs and may, depending on future developments, incur additional costs, including but not limited to costs associated with providing credit monitoring, identity theft protection, and Medical Shield to impacted individuals and maintaining a call center related to the provision of such services; incident response costs; expenses arising from potential litigation, governmental investigations, or enforcement actions; expenses related to compliance, finance, and legal advisory services; elevated cybersecurity insurance premiums; and costs incurred in meeting evolving legal and regulatory requirements concerning cybersecurity governance, monitoring, and disclosure. In addition, governmental investigations, private litigation or other claims could result in fines, other monetary relief, or injunctive relief. If, as a result of any such governmental investigation, other investigation or claim, the Company is found to be in violation of applicable laws and regulations including, without limitation, any applicable data privacy and information security laws or regulations, the Company could be subject to legal risk, including government enforcement action and civil litigation, which could adversely affect the Company’s business, reputation, financial condition or results of operations. Defending any such litigation claim or enforcement action, regardless of merit, and whether successful or unsuccessful, and cooperating with regulatory investigations, could be expensive and time-consuming and adversely affect the Company’s business, reputation, results of operations or financial condition. In addition, the Company may be adversely impacted by reputational harm or a loss of confidence in the security and integrity of our information technology systems among customers, beneficiaries, employees, agents, and others.