{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2026-identity-protection-firm-aura-breached-in-vishing-attack-900-000-records"},"incident":{"title":"Identity protection firm Aura breached in vishing attack; ~900,000 records taken","date":"2026-03","date_precision":"month","victim_org":"Aura","sector":"Technology","country":"United States","primary_vector":"Vishing (Voice Phishing)","secondary_vectors":[],"ai_involvement":"Unknown","ai_notes":"No confirmation that synthetic voice was used on the call that compromised the employee account.","outcomes":["Data Breach","Extortion"],"loss_usd":null,"loss_note":"No loss figure disclosed.","records_affected":900000,"threat_actor":"ShinyHunters","summary":"Aura, a Burlington, Massachusetts identity protection company, was breached in March 2026 when a vishing attack compromised an employee account for roughly an hour before the access was removed. Approximately 900,000 records were taken from a marketing database acquired through Circle Media Labs, containing names, home addresses, telephone numbers and email addresses. The breach drew attention because many affected individuals were customers who had bought protection against exactly this kind of threat.","how_it_worked":"The attackers targeted a single employee account with a voice phishing call, the same pattern the group used against Okta and Microsoft Entra single sign-on accounts throughout early 2026: pose as internal IT, offer help with an authentication task, and capture credentials and a one-time code through a lookalike login page. The compromised account was live for only about an hour, but that was long enough to export a marketing database wholesale. The stolen combination of name, address, phone and email is itself high-quality raw material for follow-on phishing and vishing.","lessons":"Short-lived access still enables bulk export; rate-limiting and alerting on large database exports would have caught the theft inside the one-hour window.","confidence":"Reported","sources":[{"title":"Aura data breach","url":"https://en.wikipedia.org/wiki/Aura_data_breach","publisher":"Wikipedia"}],"entry_type":"incident","slug":"2026-identity-protection-firm-aura-breached-in-vishing-attack-900-000-records","year":2026,"loss_kind":null,"url":"https://global-social-engineering-impact-da.vercel.app/incidents/2026-identity-protection-firm-aura-breached-in-vishing-attack-900-000-records"}}