Aura Group Data Breach Exposes Nearly 1 Million Records in Phishing Attack Shamis & Gentile P.A., a class action law firm specializing in data breach cases, is investigating a security incident at Aura Group, a U.S.-based digital security company founded in 2009. The breach occurred after an employee fell victim to a targeted phone phishing attack, allowing an unauthorized third party to access an internal account for roughly one hour. On March 11, 2026, the threat actor ShinyHunters claimed responsibility for the breach on the dark web, initially asserting that over two million records had been compromised. Aura Group later confirmed that approximately 900,000 records were accessed, primarily consisting of names and email addresses from a marketing tool acquired in 2017. Additionally, contact information including home addresses and phone numbers was exposed for fewer than 20,000 active customers and 15,000 former customers. Aura Group clarified that no Social Security numbers, passwords, or financial data were compromised in the incident. The company has since taken steps to secure affected systems and mitigate further risk. Legal investigations are underway, with potential compensation available for impacted individuals.