Hackers Hit Aura, An Identity Protection Provider, Stealing 900K Records

Aura, a US provider of identity protection services, has suffered a breach involving a hacker stealing 900,000 records about the company’s users.

On Tuesday night, the breach notification service Have I Been Pwned first flagged the incident, a couple days after the notorious hacking group ShinyHunters claimed responsibility.

The breach is ironic considering Aura —which has over 1 million customers— sells services to protect users from identity theft and scams. In a statement, the company confirmed the compromise, tracing it to an Aura employee falling for a “targeted phone phishing attack.” This suggests the attacker impersonated a trusted contact or figure to trick the employee.

“We identified that an unauthorized third-party gained access to that employee’s account for approximately one hour,” the company said. Although Aura was quick to terminate access, the attacker was still able to access “900,000 records, the vast majority of which consist of names and email addresses from a marketing tool used by a company Aura acquired in 2021.”

“We believe the contact information (name, email, home address, phone number) for less than 20,000 active Aura customers and less than 15,000 former Aura customers was accessed. No Social Security numbers, passwords, or financial information were compromised,” the statement adds.

It also looks like the stolen information has already leaked. The ShinyHunters gang has been spotted posting the looted records in a 12GB file after it failed to reach an extortion agreement with Aura. Have I Been Pwned adds that “exposed data included names, phone numbers, physical and IP addresses, and customer service notes.”

This Tweet is currently unavailable. It might be loading or has been removed.

In response, Aura says it’s in the process of notifying affected users. “While we make every effort to ensure that our customers have peace of mind about their safety, we recognize that in this case we did not live up to that standard. We are committed to earning our customers’ continued trust,” the statement added. The company also noted its internal systems were purpose-built to limit the potential exposure of customer information in the event of a breach.

Recommended by Our Editors

“All sensitive customer personal information (Social Security numbers, financial transactions, credit files, payment details, credentials) is encrypted and access is highly restricted,” the company added.

However, Aura’s announcement about the breach previously contained a “robots noindex” tag, which prevented search engines from indexing the web page. The company told PCMag: “This was an error and has been corrected.”

Users who’ve experienced a breach can check out our article on steps to protect yourself.