- 5.5 million customers caught up in ADT’s third major data breach in under a year.
- ShinyHunters group leaked an 11GB archive of stolen data on the dark web after failed extortion.
- No payment data stolen, but names, addresses, and some Tax IDs are now in criminal hands.
Home security giant ADT has suffered another big data breach, making it the company’s third security incident recently.
This time around, popular hacking group ShinyHunters is behind the attack. They’ve already started leaking the stolen info online.
The Break-In and The Leak
Let me walk you through what happened. The hackers broke into ADT’s systems on April 20.
They grabbed both customer and corporate data. ADT confirmed that they detected the intrusion as soon as it happned and then immediately blocked the hackers’ access. However, the attacker had already caused a damage. The group first tried to extort ADT. They threatened to leak everything unless the company paid up.
ADT refused to pay. So, ShinyHunters followed through and dumped a massive 11GB of stolen data on the dark web. Then, security researchers at Have I Been Pwned checked the dump out and they confirmed that this leak affected about 5.5 million people.
ADT hasn’t officially disclosed that number yet. But Have I Been Pwned did the math for them.
What Data Actually Got Stolen?
The stolen records contains personal identifiable info, which includes both names, phone numbers, and people’s home addresses. But that’s not all. The hackers also got dates of birth. Plus the last four digits of Social Security numbers or Tax IDs.
Here’s the good news. No payment information was exposed. That means no credit card data or bank account numbers. ADT confirmed this to BleepingComputer after the group claimed they stole over 10 million records. The company says the intrusion wasn’t extensive.
Still, any stolen personal data is a risk. Especially when it lands in the hands of a group like ShinyHunters.
This Isn’t ShinyHunters’ First Rodeo
This group isn’t slowing down. Far from it. Last week, they claimed to have stolen over 9 million records from medical device maker Medtronic. They’ve also hit the European Commission, Rockstar Games, and McGraw-Hill recently. Add 7-Eleven, Carnival, Zara, and Udemy to that list too.
In just a few weeks, they’ve breached some of the biggest names out there. ADT is just one stop on their rampage.
What ADT Customers Should Do Right Now
If you’re an ADT customer, don’t panic. But do take action. Here’s your game plan. First, watch your physical mailbox closely. ADT is sending out data breach notification letters the old-fashioned way. Not by email or text.
That letter will tell you exactly what data of yours the breach exposed. It will also include a code for free identity theft protection. ADT has already committed to paying for that service. You just need that code to sign up.
Second, be extra careful with your inbox because it’s likely your email address is among the leak. That makes you a target for phishing attacks. ShinyHunters could sell your info to other hackers. Those hackers will then send you fake emails, which they’ll probably put malicious links or malware into.
In order not to catch malware through those emails, get a reliable antivirus for both your PC or mobile phone. It’ll help detect and block malware and also protect you from bad links. Don’t rush to buy identity theft protection on your own. ADT will provide it for free to affected customers. Just wait for that letter to arrive.
The Bottom Line
This marks ADT’s third breach in under a year. Previous ones exposed customer and employee data back in August and October of 2024.
The company keeps getting hit. And ShinyHunters keeps leaking.
Law enforcement needs to catch this group sooner rather than later. Until then, every company should take this threat very seriously.
ADT joins a growing list of victims who refused to pay. As seen when the ShinyHunter group released stolen Rockstar files after ransom refusal, these hackers follow through on their threats. Companies must prepare not just to resist extortion, but to respond decisively when their data ends up on the dark web.”
And if you’re an ADT customer? Stay alert, watch your mail, and double-check every email you get.
