Loading story…
Aura confirmed a data breach affecting nearly 900,000 records after an attacker used a voice phishing tactic against an employee to gain unauthorized access. Reporting indicates the exposed information included email addresses and, in some cases, names, phone numbers, physical addresses, IP addresses, and customer service notes. Aura said the incident did not expose Social Security numbers, passwords, or financial information.
Additional breach details indicate the compromised data was largely tied to a marketing tool associated with a previously acquired company, and that fewer than 20,000 active Aura customers were affected despite the much larger total record count. The incident is a substantive security event rather than promotional or advisory content, and the available sources align on the same breach while differing mainly in emphasis: one focuses on the social engineering intrusion vector, and another on the scope and data types exposed.
See attribution, scope, and your downstream exposure.
7 events from the most recent confirmed update back to the earliest known activity.
Aura said it was conducting an internal review with cybersecurity experts, had notified law enforcement, and planned to send personalized notifications to affected individuals. These actions were reported after the company confirmed the breach.
The threat group ShinyHunters claimed responsibility for the Aura intrusion and said it exfiltrated 12GB of files. This attribution was reported alongside Aura's confirmation of the breach.
Have I Been Pwned listed the Aura breach and reported that about 90% of the exposed email addresses were already present in its database from prior breaches. The listing identified 900,000 unique email addresses in the incident.
Aura said the compromised information included names, phone numbers, physical addresses, IP addresses, and customer service notes. The company stated that Social Security numbers, passwords, and financial information were not exposed.
In March 2026, Aura disclosed a data breach affecting about 900,000 records, including 900,000 unique email addresses according to Have I Been Pwned. Aura said most exposed data came from the acquired marketing tool, while fewer than 20,000 active customers were impacted.
Aura said a targeted voice phishing attack against an employee allowed an unauthorized party to gain access to company data. SC Media reported the intrusion involved compromised employee credentials.
Aura said the exposed data was primarily tied to a marketing tool from a company it acquired in 2021. This system later became the main source of the compromised records.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourceteiss.co.uk
Open sourcehaveibeenpwned.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Salesforce warned of increased threat activity targeting **publicly accessible Experience Cloud** sites where **guest user profiles** are misconfigured with overly permissive access, enabling unauthenticated users to query and exfiltrate Salesforce CRM data via the Aura framework’s exposed API endpoints (notably `/s/sfsites/aura`). Salesforce stated it has **not identified an inherent platform vulnerability**, attributing the risk to customer configuration—specifically excessive permissions granted to the Experience Cloud guest user profile. Salesforce said attackers are using a **modified version of *AuraInspector***—an open-source auditing tool released by Mandiant—to move beyond identifying exposed objects to **mass scanning and data extraction** from affected sites. Separately, **ShinyHunters** publicly claimed it is conducting ongoing data-theft activity and characterized the issue as a “new bug,” while Salesforce reiterated the activity is driven by misconfiguration and issued mitigation guidance emphasizing least privilege, auditing guest permissions, and high-impact hardening such as **disabling guest access to public APIs** and removing the **`API Enabled`** permission from the guest profile.
Jun 29, 2026
Figure and Allianz Life disclosed separate breaches in which attackers used **social engineering** to gain access to systems holding large volumes of customer data. Figure said an employee was deceived into granting access, leading to the public posting of a dataset from January 2026 that contained more than **900,000 unique email addresses** as well as names, phone numbers, physical addresses, and dates of birth. Allianz Life reported that a cyberattack in July 2025 targeted data stored on **Salesforce** and was later followed by the online leak of **1.1 million unique email addresses**. The exposed Allianz Life records also included names, genders, dates of birth, phone numbers, and physical addresses, underscoring how social engineering attacks continue to drive large-scale exposure of sensitive personal information across financial services firms.
Jun 29, 2026
Astrana Health disclosed that attackers impersonated company personnel and spoofed its main corporate telephone number in a social-engineering campaign that gained access to company servers. The California-based healthcare-management company confirmed that private and confidential information was exfiltrated, while it investigates whether patient, employee, provider, business, financial, intellectual-property, or other sensitive data was affected. Astrana characterized the incident as material because of the potentially sensitive information involved, though it said it does not expect a material impact on financial condition or operations. The company rotated credentials, restricted remote-access tools, rebuilt and restored affected systems from clean backups, and enhanced monitoring, logging, and detection; it also notified law enforcement, regulators, customers, and partners. No threat actor had claimed responsibility, and Astrana has not confirmed ransomware involvement.
Sep 26, 2026