What happened
ADT detected unauthorised access on April 20, 2026 and confirmed the breach publicly on April 24, 2026. Attackers used voice phishing against an employee's Okta single sign-on account, then stole data from the company's Salesforce instance. Exposed data included names, phone numbers and addresses, with dates of birth and the last four digits of Social Security or Tax ID numbers in a small percentage of cases. ShinyHunters claimed more than 10 million records; ADT did not confirm that figure.
How the deception worked
An operator called an ADT employee posing as internal support and used a plausible authentication pretext to route them to a company-branded fake sign-in page. The page relayed the credentials and one-time code to the real Okta login in real time, giving the attacker a live SSO session. Because Salesforce sat behind that same single sign-on, the session opened the CRM directly, and the attackers exported customer and prospect records in bulk before ADT terminated the intrusion. Extortion followed, with a leak deadline set three days after public confirmation.
AI involvement · Suspected AI-enabled
Mandiant documented this actor set using AI voice agents in its vishing operations; AI use in the ADT call was not separately confirmed.
The control that would have caught it· our reading, not a claim from the sources
Phishing-resistant passkeys bound to managed devices, plus export-volume alerting on the CRM, would have blocked both the credential relay and the bulk extraction.
Sources (2)
- ADT confirms data breach after ShinyHunters leak threatBleepingComputer·bleepingcomputer.comOpen ↗
- ADT Salesforce Data Breach 2026: ShinyHunters Compromise Okta SSO via Vishing AttackRescana·rescana.comOpen ↗
This entry summarises public reporting. It is not a legal finding, and details can change as investigations conclude. Found an error? Send a correction.