cyber.hendryadrian.com
Cyber Attack & Data Breach · bleepingcomputer.com

ADT Breach Exposes Personal Data of 5.5 Million, Have I Been Pwned Estimates

· Original article ↗

Summary

ADT confirmed an intrusion exposed some personal information; Have I Been Pwned estimates 5.5 million people were affected. ShinyHunters claimed access via an employee’s Okta SSO account and theft from Salesforce.

Key points

  • ADT said it detected the intrusion on April 20 and its investigation found attackers accessed some individuals’ personal information.
  • ADT said exposed information included names, phone numbers and addresses; a small percentage of cases also included dates of birth and the last four digits of Social Security numbers or Tax IDs.
  • Have I Been Pwned analyzed the leaked data and estimated 5.5 million unique individuals were affected.
  • ShinyHunters published an 11GB archive after, according to the article, failing to extort ADT.
  • ShinyHunters claimed it compromised an employee’s Okta SSO account through vishing and used it to access data in ADT’s Salesforce instance.
  • ADT said payment information was not accessed and customer security systems were not affected.

Article Details

Victim Organization
ADT
Incident Type
Data breach involving unauthorized access and theft of personal information; the attackers alleged they gained access through employee vishing.
Data Types Exposed
  • Names
  • Phone numbers
  • Physical addresses
  • Dates of birth
  • Unique email addresses
  • Last four digits of Social Security numbers or Tax IDs
  • Partial government-issued IDs
Affected Records
Have I Been Pwned estimated 5.5 million unique individuals were affected; ADT had not disclosed a total.
Affected Data Size
An 11GB archive of stolen data was leaked, according to the article.
Operational Impact
ADT said customer security systems were not affected or compromised and no payment information was accessed.
Ransom Or Extortion
ShinyHunters reportedly failed to extort ADT and then leaked the data. The group claimed it had stolen the information.
Claim Status
confirmed

MITRE ATT&CK

T1078.004 · Cloud AccountsShinyHunters claimed to have used the compromised employee SSO account to access ADT systems.T1566.004 · Spearphishing VoiceShinyHunters claimed to have used voice phishing (vishing) to compromise an ADT employee's Okta SSO account.

Threat Actors

ShinyHuntersThe group claimed it breached ADT, stole personal information, and allegedly accessed Salesforce data using an employee's compromised Okta SSO account. The article reports that an 11GB archive was subsequently leaked after an extortion attempt.

Products

OktaAttackers claimed to gain access by vishing an employee’s Okta SSO and extracting data from Salesforce.SalesforceAttackers claimed to gain access by vishing an employee’s Okta SSO and extracting data from Salesforce.

Countries

United Statesin 1874 as American District Telegraph, ADT is the oldest and largest home security company in the United States, currently providing monitored security and smart home solutions to over 6 million residential and

Industries

Home securitygroup stole the personal information of 5.5 million individuals after breaching the systems of home security giant ADT earlier this month, according to data breach notification service Have I Been Pwned.

Related Articles