ADT breach: ShinyHunters threatens to leak stolen data
What's the story
Leading home security company, ADT, has confirmed a data breach after the notorious ShinyHunters hacking group threatened to leak stolen information. The company detected unauthorized access to its customer and potential customer data on April 20. Following this discovery, it terminated the intrusion and launched an investigation into the matter. The probe revealed that personal information was indeed stolen during the breach.
Data details
No payment information accessed during the breach
ADT confirmed that the stolen data was limited to names, phone numbers, and addresses. In a few cases, dates of birth and the last four digits of Social Security numbers or Tax IDs were also included. However, the company emphasized that no payment information such as bank accounts or credit card details were accessed during this breach.
Company actions
ADT described the intrusion as limited in nature
ADT has described the intrusion as limited in nature and has reached out to all affected individuals. This comes after the company was listed on the ShinyHunters data leak site, where hackers claimed to have stolen 10 million records containing customers' personal information. "Over 10 million records containing PII and other internal corporate data have been compromised. Pay or Leak," reads the post on their website.
Attack technique
ShinyHunters claimed they breached ADT through a voice phishing attack
ShinyHunters claimed they breached ADT through a voice phishing (vishing) attack that compromised an employee's Okta single sign-on (SSO) account. With this account, the hackers allegedly accessed and stole data from the company's Salesforce instance. This isn't the first time ADT has suffered a data breach; it had also disclosed similar incidents in August and October 2024, which exposed customer and employee information.