ADT Confirms Customer Data Breach After ShinyHunters Leak Threat

Summary

ADT says attackers accessed and stole customer and prospective-customer data on April 20, including names, phone numbers and addresses. ShinyHunters’ claim of 10 million stolen records remains unconfirmed by ADT.

Key points

ADT said it detected unauthorized access on April 20, terminated the intrusion and launched an investigation.
ADT confirmed that names, phone numbers and addresses were stolen; a small percentage of cases also involved dates of birth and the last four digits of Social Security numbers or Tax IDs.
ADT said payment information and customer security systems were not affected, and that it contacted all affected individuals.
ShinyHunters listed ADT on its leak site and claimed to have stolen 10 million records; ADT did not confirm that volume.
ShinyHunters alleged that vishing compromised an employee’s Okta SSO account, which was then used to access data in ADT’s Salesforce instance.

Article Details

Victim Organization: ADT
Incident Type: Confirmed unauthorized access to customer and prospective-customer data, followed by theft of personal information. ShinyHunters alleged that access was obtained through vishing that compromised an employee's Okta SSO account and enabled access to Salesforce.
Incident Date: 2026-04-20
Disclosure Date: 2026-04-24
Data Types Exposed: Names
Phone numbers
Addresses
Dates of birth (in a small percentage of cases)
Last four digits of Social Security numbers or Tax IDs (in a small percentage of cases)
Affected Records: ADT did not confirm the volume. ShinyHunters claimed that over 10 million records were compromised.
Operational Impact: ADT said it terminated the intrusion, launched an investigation, and contacted affected individuals. It described the intrusion as limited and said customer security systems were not affected or compromised.
Ransom Or Extortion: ShinyHunters demanded payment by April 27, 2026, threatening to leak data and cause additional digital problems. The article does not report whether a ransom was paid.
Claim Status: confirmed

MITRE ATT&CK

T1078 · Valid AccountsShinyHunters claimed to have used the compromised employee SSO account to access company data.T1566.004 · Spearphishing VoiceShinyHunters allegedly used a voice phishing (vishing) attack to compromise an employee's SSO account.

Threat Actors

ShinyHuntersShinyHunters told BleepingComputer that it allegedly breached ADT through vishing, compromised an employee's Okta SSO account, and accessed and stole data from Salesforce. It claimed over 10 million records were compromised; ADT did not confirm that volume.

Products

OktaShinyHunters told BleepingComputer they allegedly breached ADT through a voice phishing (vishing) attack that compromised an employee’s Okta single sign-on (SSO) account.SalesforceUsing this account, the threat actors claimed they accessed and stole data from the company's Salesforce instance.