ADT confirmed a significant data breach after the extortion group ShinyHunters claimed to have stolen personal information. The notification service Have I Been Pwned reported the breach exposed data for 5.5 million people. Compromised information includes names, addresses, phone numbers, and email addresses.
ShinyHunters alleged they stole over 10 million records by compromising an employee's Okta single sign-on account via voice phishing. The attackers used this access to enter the company's Salesforce instance. ADT confirmed some records included dates of birth and the last four digits of Social Security or Tax IDs.
ADT detected the unauthorized access on April 20. The company stated the breach was limited and did not compromise financial information or security system data. This incident represents ADT's third publicly disclosed data breach since August 2024.