ADT Faces Class Action Lawsuit Over April 2026 Data Breach Exposing 10 Million Records A proposed class action lawsuit alleges that ADT, a major provider of residential and commercial security services, failed to implement adequate cybersecurity measures, leading to a significant data breach in April 2026. The attack, claimed by the cybercriminal group ShinyHunters, resulted in the unauthorized access of over 10 million records containing sensitive customer information. The 35-page complaint details that the breach, occurring on or around April 20, 2026, exposed personally identifiable information (PII), including names, phone numbers, addresses, dates of birth, partial Social Security numbers, and tax IDs. The lawsuit argues that ADT, aware of its status as a high-value target due to the volume and sensitivity of data it collects, neglected to follow Federal Trade Commission (FTC) guidelines on data protection. The suit further contends that ADT’s response to the breach has been insufficient. While the company issued a public statement four days after the incident, affected individuals remain uninformed about the specifics of the breach, the exact data compromised, and the steps ADT has taken to mitigate the damage. The complaint also criticizes ADT for failing to provide timely notifications and the promised identity protection services. The exposed data, particularly Social Security numbers, places victims at long-term risk of identity theft, fraud, and phishing attacks. The lawsuit seeks to represent all U.S. individuals whose information was compromised in the breach.

Sextortion Scammers Exploit ShinyHunters Data Leaks in $2,000 Bitcoin Scheme Cybercriminals are leveraging email addresses from past ShinyHunters data breaches to lend false credibility to a new wave of sextortion scams, demanding $2,000 in Bitcoin from victims. The campaign, reported by BleepingComputer, targets individuals whose personal data was exposed in breaches of companies like Amtrak, Hallmark, ADT, Substack, Betterment, CarGurus, Panera Bread, and McGraw Hill, as well as those affected by the Canvas data breach at a California community college. The scam emails falsely claim to be from ShinyHunters, alleging that the group has compromised victims’ devices, recorded explicit content via webcams, and threatens to leak the footage unless payment is made within 48 hours. A sample email includes a Bitcoin wallet address currently showing no transaction activity and falsely asserts access to browsing history, contacts, and other sensitive data. Despite the threats, no evidence supports the claims. ShinyHunters has denied involvement, and security experts confirm the emails are bluffs, relying on psychological manipulation rather than actual malware or recordings. The scammers likely obtained the email lists from publicly leaked data after ShinyHunters’ failed extortion attempts. The $2,000 demand marks an increase from typical sextortion scams, possibly indicating the scammers acquired the data through purchase or direct download. While the emails vary in sophistication some appearing AI-polished they uniformly lack verifiable proof. Security researchers emphasize that responding to such emails can confirm an active account, leading to further targeting. Victims are advised to ignore the threats, avoid engaging with the scammers, and report the emails as spam. If the message includes a previously used password, users should change it immediately and enable two-factor authentication (2FA). The campaign underscores how leaked data continues to fuel cybercrime, even when the original breach has been addressed.