Aura Suffers Data Breach After Employee Falls Victim to Voice Phishing Attack Aura, an online safety and identity protection provider, disclosed a data breach affecting approximately 900,000 records after a targeted voice phishing (vishing) attack compromised an employee’s account. The incident, which occurred when an unauthorized third party gained access for roughly an hour, was detected and contained quickly, with Aura revoking access, activating its incident response plan, and engaging external cybersecurity and legal experts. The majority of the exposed records primarily names and email addresses were stored in a marketing tool linked to a company Aura acquired in 2021. However, the breach also included contact details (names, emails, home addresses, and phone numbers) for fewer than 20,000 active customers and 15,000 former customers. Aura confirmed that sensitive data, such as Social Security numbers, passwords, and financial information, was not accessed. The breach gained attention after the ShinyHunters threat group advertised the stolen data, claiming it included personally identifiable information (PII) and internal corporate material. ShinyHunters alleged the attack exploited an Okta single sign-on (SSO) vulnerability. Meanwhile, Have I Been Pwned (HIBP) added the incident to its database, reporting that the leaked data affecting 903,100 accounts also included IP addresses and customer service notes. HIBP noted that about 90% of the records were already circulating from prior breaches. Aura is notifying affected individuals and offering support, though the company emphasized that its core sensitive data stores remained secure. The incident underscores the risks of social engineering attacks, even for firms specializing in cybersecurity.