One phone call gave an attacker about an hour inside an Aura employee’s account. That was enough. Aura, a U.S. consumer digital safety company that sells identity theft protection and fraud monitoring, has confirmed that nearly 900,000 records were taken after a targeted voice phishing attack on the worker.
According to the company’s statement, its team spotted the intrusion, revoked the access and started its incident response process. It brought in outside cybersecurity and legal experts and told law enforcement.
What was taken
Most of the records were names and email addresses held in a marketing tool that Aura inherited when it bought another company in 2021. Aura said the core systems behind its identity protection product were not touched. Fewer than 20,000 current customers and fewer than 15,000 former customers were also caught up, and for them the exposed details may include home addresses and phone numbers.
Aura said Social Security numbers, account passwords and financial information were not compromised. By the company’s count, only about 35,000 of the records tie directly to its own customers.
The extortion claim
The disclosure came after the group ShinyHunters listed Aura on its data extortion site and said it held 12GB of stolen files, personal data and corporate material among them. Teiss reported that the group later released the data, saying no agreement had been reached with the company.
Have I Been Pwned analysed the leaked set and counted more than 900,000 affected accounts. It also found IP addresses and customer service comments in the data, and said roughly 90% of the email addresses had already turned up in earlier breaches.
Aura has confirmed the breach itself but has not validated every claim the group has made. Bitdefender noted that questions remain over separate allegations tied to single sign-on access.
The company says it is still reviewing the incident and has begun notifying affected people individually, with support measures to follow.
Sources
- Aura data breach exposes 900,000 records
- Aura confirms data breach exposing nearly 900,000 records after voice phishing attack
- Aura's 900K-Record Data Breach Proves the Best Data Protection Is Deletion
