Aura Discloses Breach After Phone Phishing Attack Exposed Customer Data
Summary
Aura says phone phishing gave attackers access to an employee account for about an hour. Roughly 900,000 records were accessed, including contact details for about 35,000 current and former customers; Aura says passwords and financial data were not compromised.
Key points
- Aura says a phone phishing attack gave attackers access to an employee’s account for approximately an hour.
- The attackers reportedly accessed roughly 900,000 records, mostly names and email addresses in a marketing tool used by a company Aura acquired in 2021.
- Aura says the exposed information included names, email addresses, addresses, and phone numbers for roughly 20,000 current and 15,000 former customers.
- Aura says Social Security numbers, passwords, and financial information were not compromised.
- Aura says it terminated account access, activated its incident response plan, engaged outside experts, and notified law enforcement.
- Aura says it has begun notifying affected customers; the company did not disclose when the attack occurred or who was responsible.
Article Details
- Victim Organization
- Aura
- Incident Type
- Phone phishing attack leading to unauthorized access to an employee's account and a data breach
- Data Types Exposed
- Names
- Email addresses
- Physical addresses
- Phone numbers
- Affected Records
- Approximately 900,000 records were accessed, most consisting of names and email addresses in a marketing tool. The exposed information included records for roughly 20,000 current and 15,000 former customers.
- Operational Impact
- The attackers accessed an employee's account for approximately one hour. Aura terminated access, activated its incident response plan, engaged external cybersecurity and legal experts, notified law enforcement, and began notifying impacted customers. No service disruption was reported.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed