Aura disclosed in March 2026 that an unauthorized third party accessed an employee account through a targeted voice-phishing attack. The intruder reportedly retained access for about one hour before Aura’s security team removed them, and obtained approximately 900,000 records from a marketing database, including names, home addresses, telephone numbers, email addresses, telephone numbers, and other associated data. The database was connected to Circle Media Labs, acquired by Aura in 2021. ShinyHunters claimed responsibility around March 16, 2026, and threat-intelligence reporting recorded Aura data on the group’s leak site.
Aura sells identity-theft protection, credit monitoring, antivirus, and online-security services, making the compromise especially consequential for customers seeking protection from social engineering. Aura’s investigation and Have I Been Pwned reportedly confirmed the approximate record count; security researchers warned that the combined contact data could enable highly credible phishing and vishing campaigns. The incident also exposed the risk of retaining legacy acquisition data and marketing systems without adequate protections. The supplied account does not identify a government fine, lawsuit, or other final regulatory penalty arising from the breach.
