ADT breach exposes 5.5 million email addresses and customers’ home contact details
Stolen ADT customer and prospective customer data included home contact details; HIBP identified 5.5 million email addresses. ADT says alarms and payment information were unaffected. Verify unexpected calls independently and review your credit reports.
Verify unexpected calls, texts or emails claiming to be ADT by contacting the company through its official website. Review your credit reports for unfamiliar activity and consider a fraud alert if your identity details were exposed. Ask ADT whether identity support remains available: its June letter required enrolment within 90 days.
What’s happening
ADT discovered unauthorised access to its cloud environments on 20 April 2026. It confirmed exposure of customer and prospective customer names, phone numbers and addresses, with dates of birth and the last four digits of Social Security numbers or Tax IDs in a small percentage of cases. Have I Been Pwned identified 5.5 million unique email addresses in the breach data; that is not a verified count of individual customers. BleepingComputer reported that ShinyHunters released an 11GB archive after attempting extortion. ADT said it stopped the intrusion, notified affected people and found no access to payment information or customer security systems. A follow-up letter dated 29 June offered eligible recipients 12 months of credit monitoring and fraud assistance, with a 90-day enrolment deadline. Regulatory notifications followed in July. The reviewed sources do not establish recovery of the leaked data or criminal charges by 3 November. There is no customer software patch for this breach.
- What
- Breach
- Affects
- ADT customer and prospective customer records
- Fixed in
- Nothing to patch
- Since
- 20 Apr 2026
- Closed
- 28 July 2026
Timeline
- Update
AcidPeak's filing index records a Washington breach notification covering 5,129 state residents. The accompanying ADT documents include the June follow-up letter.
- Update
ADT dated a follow-up customer letter offering 12 months of single-bureau credit monitoring and fraud assistance through Cyberscout. Recipients had to enrol within 90 days of the letter.
- Update
Have I Been Pwned added the breach, identifying 5.5 million unique email addresses alongside personal contact details. This counts email addresses, rather than establishing the number of individual customers affected.
- Update
BleepingComputer reported that ShinyHunters had published an 11GB archive of stolen ADT data after an extortion attempt.
- Made public
ADT publicly confirmed the breach and said it had stopped the intrusion and directly notified everyone affected. It said payment information and customer security systems were unaffected.
- UpdateNothing to patch
ADT discovered unauthorised access to cloud environments holding customer and prospective customer data. It began its incident response, engaged investigators and notified law enforcement.
Sources
- ADT detects cybersecurity incidentADT · 24 Apr 2026
- ADT Form 8-K: unauthorised access discovered on April 20ADT · 24 Apr 2026
- ADT customer notifications and June 29 follow-up letterADT, published by the Washington Attorney General · 29 June 2026
- ADT Data BreachHave I Been Pwned · 27 Apr 2026
- Home security giant ADT data breach affects 5.5 million peopleBleepingComputer · 27 Apr 2026
- ADT Inc. data breach notices, Jul 27, 2026 to Jul 29, 2026AcidPeak · 30 Sept 2026