Aura Discloses Phishing Attack Linked to ShinyHunters, Exposing Nearly 1M Records Identity protection firm Aura confirmed this week that it fell victim to a targeted phone phishing attack earlier this month, orchestrated by the ShinyHunters cyber extortion group. The incident, which the company disclosed after being listed on the group’s darknet leak site, resulted in the compromise of approximately 900,000 customer records. The attack began when a single employee’s account was breached for roughly one hour before Aura detected the intrusion. The company responded by terminating access, activating its incident response plan, and engaging external cybersecurity and legal experts, as well as notifying law enforcement. While the breach was brief, the impact was severe: the majority of the exposed records contained names and email addresses from a marketing tool inherited through a 2021 acquisition. Aura clarified that fewer than 20,000 active customers and less than 15,000 former customers were affected. Critically, the company stated that no Social Security numbers, passwords, or financial information were accessed. ShinyHunters, however, claimed on its leak site that 12GB of data including personally identifiable information (PII) and internal corporate records had been stolen and published online. The group alleged that Aura failed to negotiate despite multiple offers, stating, “They don’t care.” This attack is part of a broader campaign by ShinyHunters, which has targeted multiple organizations since late 2023 by exploiting vulnerabilities in Salesforce instances. Other victims of the group include SoundCloud, Crunchbase, Bumble, and Harvard University, among at least 20 others. Salesforce has since issued guidance for customers to secure their systems.

Aura Confirms Data Breach Affecting Nearly 900,000 Records After Vishing Attack Aura, a digital security provider, disclosed a data breach exposing nearly 900,000 records following a voice phishing (vishing) attack targeting an employee. The incident stemmed from a marketing platform acquired in 2021, rather than Aura’s core account systems. The compromised data included full names, email addresses, home addresses, and phone numbers, impacting approximately 20,000 current and 15,000 former customers. A larger pool of marketing contacts was also exposed. Notably, Social Security numbers, passwords, and financial details were not accessed, reducing the risk of immediate account takeovers. However, the stolen contact information could fuel follow-up phishing, impersonation, or fraud campaigns. The breach gained attention after the threat group ShinyHunters claimed responsibility, listing Aura on its extortion site and alleging the theft of 12GB of files containing customer and internal corporate data. While Aura confirmed the breach, it has not verified all of ShinyHunters’ claims, including broader allegations about single sign-on access. Data breach monitoring services later reported a leaked CRM dataset with over 900,000 email records, some of which had appeared in prior breaches. The exposed data may also include IP addresses and customer service notes. Aura is collaborating with external cybersecurity experts, has notified law enforcement, and plans to contact affected individuals directly. The incident underscores the risks associated with inherited systems from mergers and acquisitions, as well as the persistent threat of phishing-led compromises leading to extortion and data leaks. The breach has been added to Have I Been Pwned, allowing users to check if their information was exposed.