(Aura)
Aura, a US provider of identity protection services, has suffered a breach involving a hacker stealing 900,000 records, including some covering Aura users.
However, the company says, "no database supporting the Aura identity theft protection application was accessed in any way." Instead, Aura is emphasizing that the hacker only accessed marketing lists. "There is no ongoing risk to customer data, and Aura’s services remain safe to use," the company said in an updated statement.
On Tuesday night, the breach notification service Have I Been Pwned first flagged the incident, a couple days after the notorious hacking group ShinyHunters claimed responsibility.
The breach is ironic considering Aura —which has over 1 million customers— sells services to protect users from identity theft and scams. In a statement, the company confirmed the compromise, tracing it to an Aura employee falling for a “targeted phone phishing attack." This suggests the attacker impersonated a trusted contact or figure to trick the employee.
“We identified that an unauthorized third-party gained access to that employee’s account for approximately one hour,” the company said. Although Aura was quick to terminate access, the attacker was still able to access “900,000 records, the vast majority of which consist of names and email addresses from a marketing tool used by a company Aura acquired in 2021.”
“We believe the contact information (name, email, home address, phone number) for less than 20,000 active Aura customers and less than 15,000 former Aura customers was accessed. No Social Security numbers, passwords, or financial information were compromised,” the statement adds.
It also looks like the stolen information has already leaked. The ShinyHunters gang has been spotted posting the looted records in a 12GB file after it failed to reach an extortion agreement with Aura. Have I Been Pwned adds that “exposed data included names, phone numbers, physical and IP addresses, and customer service notes.”
In response, Aura says it’s in the process of notifying affected users. “While we make every effort to ensure that our customers have peace of mind about their safety, we recognize that in this case we did not live up to that standard. We are committed to earning our customers’ continued trust,” the statement added. The company also noted its internal systems were purpose-built to limit the potential exposure of customer information in the event of a breach.
“All sensitive customer personal information (Social Security numbers, financial transactions, credit files, payment details, credentials) is encrypted and access is highly restricted,” the company added.
However, Aura’s announcement about the breach previously contained a “robots noindex” tag, which prevented search engines from indexing the web page. The company told PCMag: “This was an error and has been corrected.”
Users who've experienced a breach can check out our article on steps to protect yourself.
Editor's note: This story has been updated with more information from Aura.