Nearly 900,000 records. That is the number Aura attached to a breach it has now confirmed, and it traces back to a single employee who took the wrong phone call.
The company, which sells identity theft protection, said the worker was hit by a voice phishing attack, often shortened to vishing. The incident involved a marketing platform Aura picked up through a 2021 acquisition, not its core account systems.
The exposed data included full names, email addresses, home addresses and phone numbers. About 20,000 current customers and 15,000 former customers were affected, the company said, alongside a much larger pool of marketing contacts. Social Security numbers, passwords and financial information were not exposed, according to Aura.
ShinyHunters got there first with the publicity. The group listed Aura on its extortion site and claimed to have stolen 12GB of files holding customer information and internal corporate data. Monitoring services later reported a leaked CRM dataset with more than 900,000 email records, and Have I Been Pwned has added the breach to its service. Trackers say the leaked data may include IP addresses and customer service comments, and one report found that most of the email addresses had appeared in earlier breaches.
Aura has confirmed the breach but has not signed off on everything the group says. Public reporting also points to unresolved questions around separate claims involving single sign-on access.
The company says it is working with external cybersecurity experts, has notified law enforcement and plans to contact affected individuals directly. Bitdefender, which reported the story, warned that names, addresses and phone numbers are still useful to scammers writing convincing phishing messages or impersonating victims.
One more detail from the disclosure: the data sat in a tool that arrived with a deal years earlier, and that is where the exposure grew.
