ADT Confirms Breach of 5.5 Million Customers After ShinyHunters Vish an Okta SSO Account and Loot Salesforce
Home security giant ADT says attackers detected on April 20 stole names, phone numbers and addresses for 5.5 million customers after voice-phishing an employee's Okta single sign-on. ShinyHunters published an 11GB archive when the company refused to pay.
Overview
ADT, one of North America’s largest home security and alarm monitoring providers, confirmed on April 27 that intruders accessed customer data after compromising the company’s cloud environments earlier in the month. The extortion group ShinyHunters has claimed responsibility, and data breach notification service Have I Been Pwned listed 5.5 million unique email addresses tied to the incident, according to BleepingComputer.
The disclosure makes ADT the latest victim of a months-long ShinyHunters campaign that has weaponised voice phishing against Okta single sign-on accounts to reach Salesforce data, a pattern The Machine Herald has tracked since March.
What We Know
- ADT detected unauthorised access on April 20 and “terminated the intrusion and launched an investigation,” according to BleepingComputer. The company also brought in outside incident responders and looped in law enforcement, as reported by The Register.
- The exposed information was “limited to names, phone numbers, and addresses,” with “a smaller slice including dates of birth and the last four digits of Social Security or tax ID numbers,” as reported by The Register.
- ADT emphasised that no payment information was accessed and that customer alarm and monitoring systems were not affected, according to BleepingComputer.
- ShinyHunters told BleepingComputer the intrusion began with a voice-phishing call that compromised an employee’s Okta single sign-on account, which the group then used to access ADT’s Salesforce instance and exfiltrate customer records.
- After ADT declined to negotiate, ShinyHunters published an 11GB archive of stolen data on its dark web leak site, according to BleepingComputer.
- The group’s listing on its data-leak blog claimed “over 10 million records,” but Have I Been Pwned independently verified 5.5 million unique email addresses, according to BleepingComputer.
- ShinyHunters told The Register, “The company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made,” as reported by The Register.
A Pattern, Not an Outlier
The ADT intrusion fits a now-familiar template. Beginning in late 2025, ShinyHunters and adjacent operators built voice-phishing kits that synchronise a caller’s script with browser-based credential pages, letting an attacker impersonate IT support and walk an employee through a fake Okta or Microsoft login in real time. The kits are designed to “defeat any form of MFA that is not phishing-resistant,” according to Computer Weekly, which cites Sophos research tracking roughly 150 hacker-controlled domains, most of them registered in December 2025.
The same campaign produced confirmed breaches at Crunchbase, SoundCloud and Betterment earlier in the year, according to Computer Weekly. It also overlaps with the broader Salesforce-targeted activity The Machine Herald has previously covered, where ShinyHunters claimed mass data theft from hundreds of Salesforce tenants by abusing weak guest-account configurations and tooling derived from Mandiant’s AuraInspector.
In the ADT case, the same group reached the Salesforce data via a different route — not a misconfiguration but a successful phone call. The vector underscores how identity providers and SaaS platforms have effectively merged into a single blast radius. Once an Okta session belongs to an attacker, every connected SaaS application becomes accessible, and customer-relationship platforms such as Salesforce typically hold the most sensitive contact and account data.
What We Don’t Know
- ADT has not publicly confirmed Salesforce as the specific compromised system; that detail comes from ShinyHunters’ own account to BleepingComputer.
- The exact number of records taken remains contested. ShinyHunters claims more than 10 million; Have I Been Pwned verified 5.5 million unique email addresses; ADT has described the affected data as “limited” without offering a count, according to BleepingComputer.
- ADT has not disclosed how many records contained dates of birth or partial Social Security numbers, only that it was “a small percentage,” according to BleepingComputer.
- It is not yet clear whether the company will face regulatory action over the incident; ADT previously reported breaches in August and October 2024, as reported by BleepingComputer, making this its third disclosed breach in under two years.
Analysis
The ADT breach is, on its own, a relatively contained incident: no card data, no alarm-system compromise, no operational disruption. But it lands in the middle of a campaign that has now demonstrated, repeatedly, that phishing-resistant MFA is no longer optional for any organisation that funnels privileged access through a single identity provider. The attackers did not exploit a software vulnerability or a zero-day; they exploited a help-desk script and a phone.
For security teams, the practical takeaway echoes Mandiant’s longstanding guidance summarised by Computer Weekly: deploy FIDO2 keys or passkeys, restrict the SaaS applications that any single SSO session can touch, and monitor Salesforce, Workday and similar platforms for anomalous bulk-export API calls. For ADT customers, the most immediate concern is targeted social engineering — the stolen names, phone numbers and physical addresses are themselves the raw material for the next round of vishing calls.