The breach happened in June but Aflac said it confirmed that personal data was likely included in early December.