ADT
Disclosed Apr 24, 20265 months ago331,536 affectedConfirmed
ADT confirms vishing-led Salesforce breach affecting 5.5 million people
ADT confirmed ShinyHunters voice phished an employee's Okta SSO account and accessed Salesforce data. After a failed extortion attempt the group leaked 11 GB, which Have I Been Pwned tied to 5.5 million people; a small share included partial SSNs or tax IDs.
What is known
| People affected | 331,536 (as reported by the organization) |
|---|---|
| Disclosed | Apr 24, 2026 |
| Discovered | Apr 20, 2026 |
| Happened | Apr 20, 2026 |
| Attack | Phishing |
| Data exposed | Names, Social Security numbers, Dates of birth, Emails, Government IDs, Phone numbers, Addresses |
| Sector | Tech · US |
| Status | Confirmed |
| Check your email | Have I Been Pwned |
Sources
| Source | |
|---|---|
| Washington Attorney General breach notice: ADTatg.wa.gov · Official notice | Official notice |
| Notice letter filed with the Delaware DOJ: ADTattorneygeneral.delaware.gov · Official notice | Official notice |
| Oregon DOJ breach notice: ADTjustice.oregon.gov · Official notice | Official notice |
| Have I Been Pwned: ADThaveibeenpwned.com · Aggregator | Aggregator |
| ADT confirms data breach after ShinyHunters leak threatbleepingcomputer.com · News | News |
| Home security giant ADT data breach affects 5.5 million peoplebleepingcomputer.com · News | News |
| Texas Attorney General data security breach report BR-0005212: ADToag.my.site.com · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Delaware DOJresidents of DE | Apr 24 | 1,231 |
| Researchtotal | Apr 24 | |
| Have I Been Pwnedaccounts in the data | Apr 27 | 5,488,888 |
| Washington AGresidents of WA | Jul 28 | 5,129 |
| Oregon DOJresidents of OR | Jul 28 | 331,536 |
| Texas AGresidents of TX | Jul 28 | 32,546 |
Other breaches at ADT
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Second ADT intrusion via partner credentials takes employee account dataOct 7, 20241 year agoVendor breach | Oct 7, 20241 year ago | Vendor breach | Tech | Confirmed | Unknown |
| Attackers access ADT databases holding customer order informationAug 8, 20242 years agoHacking | Aug 8, 20242 years ago | Hacking | Tech | Confirmed | Unknown |
History of this record
- 2026-09-25 · source: empty to https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage · backfill source
- 2026-09-25 · attack: hacking to phishing · seed source
- 2026-09-25 · summary: In April 2026, home security firm ADT confirmed a data breach by ShinyHunters , which listed the company on its website as part of a "pay or leak" extortion attempt. The breach impacted 5.5M unique email addresses along with names, phone nu to ADT confirmed ShinyHunters voice phished an employee's Okta SSO account and accessed Salesforce data. After a failed extortion attempt the group leaked 11 GB, which Have I Been Pwned tied to 5.5 million people; a small share included partia · seed source
- 2026-09-25 · title: empty to ADT confirms vishing-led Salesforce breach affecting 5.5 million people · seed source
- 2026-09-25 · hibp: empty to ADT · backfill source
- 2026-09-25 · sector: other to tech · backfill source
- 2026-09-25 · data_types: ["names","ssn"] to ["names","ssn","dob","emails","government-id","phone","addresses"] · backfill source
- 2026-09-25 · summary: empty to In April 2026, home security firm ADT confirmed a data breach by ShinyHunters , which listed the company on its website as part of a "pay or leak" extortion attempt. The breach impacted 5.5M unique email addresses along with names, phone nu · backfill source
- 2026-09-25 · data_types: [] to ["names","ssn"] · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 331536 · backfill source
- 2026-09-25 · disclosed: 2026-07-28 to 2026-04-24 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Washington AG), confirmed by Washington AG. Record counts are as reported. Not legal advice.