Aura employee phishing exposes about 900,000 marketing contacts, mostly from acquired Circle business
A phone-phishing attack on one Aura employee exposed about 900,000 marketing contacts, mostly names and emails from the acquired Circle business. Aura says no passwords, SSNs or financial data were taken. Expect scam emails or calls posing as Aura.
Nothing to fix or update. If you have dealt with Aura or Circle, be wary of emails, texts or calls claiming to be from Aura, and use only aura.com or its official app. Report suspicious contacts to [email protected].
What’s happening
On 17 March 2026 Aura, the identity-protection company, said a targeted phone phishing attack on one employee let an outsider into that employee's account for about an hour. About 900,000 records were accessed, mostly names and email addresses from the sales and marketing database of Circle Media Labs, a business Aura acquired in 2021. Some records also had home addresses, phone numbers or IP addresses. Aura says fewer than 20,000 active customers were included, that no database behind its identity-protection app was touched, and that no Social Security numbers, passwords or financial information were taken. It says about 90% of the email addresses had appeared in earlier unrelated breaches. BleepingComputer reported that the ShinyHunters extortion group claimed the attack and leaked about 12GB of files after talks failed; Aura declined to comment on the group's claims. Aura said it told law enforcement and is notifying affected people. Aura's last update was on 26 March; no later developments, regulator action or lawsuits were found.
- What
- Breach
- Affects
- Aura and Circle marketing contact database
- Fixed in
- Nothing to patch
- Since
- 17 Mar 2026
- Closed
- 26 Mar 2026
Timeline
- Update
Aura's longer update said most data came from Circle Media Labs' sales and marketing database, with addresses, phone numbers or IP addresses for some records. It said fewer than 20,000 active customers were affected, that it was notifying affected customers, and that about 90% of the emails had appeared in earlier unrelated breaches. No later update was found.
- Vendor revised
Aura updated its statement: no database behind its identity-protection app was accessed, the data came from marketing lists (almost all from the acquired company's contact list), and there was no ongoing risk to customer data. BleepingComputer also clarified that the 900,000 records were not Aura customer data.
- Update
BleepingComputer reported that the ShinyHunters extortion group had claimed the attack, said it stole 12GB of files and leaked them after talks failed. Aura declined to comment on the group's claims, including an alleged Okta single sign-on compromise.
- Made publicNothing to patch
Aura announced that a targeted phone phishing attack on one employee let an unauthorised party into that employee's account for about an hour. It said about 900,000 records were accessed, mostly names and email addresses from a marketing tool of a business it acquired in 2021, and that it had told law enforcement.
Sources
- Statement on exposure of customer informationAura · 19 Mar 2026
- March 2026 security incident updateAura · 26 Mar 2026
- Aura confirms data breach exposing 900,000 marketing contactsBleepingComputer · 18 Mar 2026