When the Identity Protection Company Gets Breached: The Aura Vishing Incident

There’s a particular irony reserved for security companies that become the breach headline. In March 2026, Aura, a Burlington, Massachusetts-based identity theft protection and credit monitoring company, confirmed that an attacker had accessed approximately 900,000 records — and the entry point wasn’t malware or a software flaw. It was a phone call.

How the attack worked

An Aura employee received a targeted voice phishing (vishing) call. The attacker impersonated a trusted party convincingly enough that the employee handed over access. The attacker held access to the employee’s account for roughly one hour before Aura’s team detected and shut down the intrusion.

That single hour was enough. The attacker pivoted into a marketing tool inherited from a company Aura had acquired in 2021 — legacy infrastructure that, five years later, was still holding data nobody had fully cleaned up.

What was exposed

According to Aura’s disclosure and Have I Been Pwned, the exposed data included names, email addresses, home addresses, phone numbers, IP addresses, and customer service comments. Roughly 20,000 current customers and 15,000 former customers were affected directly; the rest of the 900,000 records were names and email addresses sitting in that inherited marketing database — not active Aura account holders.

Aura says no passwords, Social Security numbers, or financial information were accessed. ShinyHunters claimed responsibility, listed Aura on its leak site on March 12 after the company declined to pay, and published the data two days later.

Part of a bigger campaign

The Aura incident wasn’t an isolated event. It occurred during a concentrated wave of ShinyHunters activity that exploited a weaponized version of an open-source Salesforce misconfiguration scanner to run reconnaissance across an estimated 300–400 organizations, roughly 100 of them high-profile. Have I Been Pwned also noted that around 90% of the leaked email addresses were already present in prior breaches — a reminder of how data aggregation compounds risk over time, even when a single incident looks contained.

Why it matters

The uncomfortable lesson here isn’t really about Aura’s technology — it’s about people and legacy data. A single successful social-engineering call against one employee was enough to reach data that had been sitting untouched since a five-year-old acquisition.

Key takeaways: - Acquired companies bring acquired data debt. Old marketing platforms and CRMs from M&A deals are common blind spots. - Vishing defeats push-based MFA and SMS codes. A convincing live caller can talk past both. - Time-to-detection matters more than perimeter defense. Aura’s one-hour detection window limited — but didn’t prevent — the damage.

Sources: SecurityWeek, Aura’s official incident notice, Bitdefender Hot for Security, and Have I Been Pwned.