In March 2026, Aura disclosed that an unauthorized third party accessed approximately 900,000 records from a marketing database after compromising an employee account through a targeted voice-phishing attack. The exposed information reportedly included names, home addresses, telephone numbers, email addresses, and other marketing data. Aura said the intruder retained access for about one hour before its security team removed the account, while the cybercriminal group ShinyHunters claimed responsibility around March 16, 2026.
Aura sells identity-theft protection, credit monitoring, fraud monitoring, and device-security services, making the breach particularly consequential for customers seeking protection from social engineering. Aura’s investigation and Have I Been Pwned reportedly confirmed the scale of the theft. Security researchers warned that the combined contact data could enable highly credible phishing and vishing campaigns. The incident also exposed risks from legacy databases retained after Aura’s 2021 acquisition of Circle Media Labs, whose marketing tools and contact lists were central to the breach. The source reports no final regulatory penalty or litigation outcome.
