Consumer Apps · Home Security · Private litigation + Data breach
ADT
Headline
ADT — a company literally in the business of protecting people's homes — has disclosed THREE DATA BREACHES SINCE AUGUST 2024 (August 2024, October 2024 and April 2026).
ADT — a company literally in the business of protecting people's homes — has disclosed THREE DATA BREACHES SINCE AUGUST 2024 (August 2024, October 2024 and April 2026). In the most recent (April 2026), according to the ShinyHunters group, an employee fell for a voice-phishing call, handing attackers an Okta single-sign-on login that led into ADT's Salesforce data; Have I Been Pwned confirmed about 5.5 million affected people — names, phone numbers, addresses, and for some, birthdates and partial Social Security numbers. The ShinyHunters extortion group gave ADT a 'pay or leak' deadline; ADT's only public acknowledgment came four days later, and the lawsuit alleges the company still hasn't told most affected customers exactly what of their data was taken. The one genuine silver lining, per ADT: no bank account or credit card data was accessed, and home security systems were not compromised.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Case status. Private litigation; the legal tier of its sources has not been assigned yet.
Primary source. www.bankinfosecurity.com/home-security-firm-adt-breach-55m-customers-data-exposed-a-31511 — Verified - primary source confirmed.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
CONFIRMED APRIL 2026 BREACH + EXTORTION ATTEMPT: ADT detected unauthorized access on April 20, 2026; attackers exfiltrated customer names, phone numbers and addresses, plus, for a smaller number of people, birthdates and the last four digits of Social Security numbers or Tax IDs; the hacker then posted a 'PAY OR LEAK' ultimatum threatening to release the stolen data and cause further 'digital problems' unless ADT responded by a set deadline (April 27, 2026) — a direct extortion attempt, not merely passive data theft. ADT did not pay and the group later released an ~11GB archive. A reported class action (captioned James v. ADT in earlier research; complaint not independently retrieved) alleges ADT knowingly kept customer PII on systems it knew were vulnerable and failed to meet FTC data-security guidelines, and separately failed to fully disclose the breach's scope to affected individuals and regulators.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
| Claim | Kind | Support | Sources |
|---|---|---|---|
| 1. ADT is a company in the business of protecting people's homes. | characterization | n/a | none recorded |
| 2. ADT has suffered three confirmed breaches in under twelve months. | fact | unsupported | none recorded |
| 3. The most recent breach occurred in April 2026. | fact | unsupported | 1 (0 confirmed) |
| 4. A single employee fell for a voice-phishing call. | fact | unsupported | none recorded |
| 5. Attackers obtained an Okta login. | fact | unsupported | none recorded |
| 6. Attackers pivoted from the Okta login into a Salesforce database. | fact | unsupported | none recorded |
| 7. The breached database held 5.5 million customer records. | fact | supported | none recorded |
| 8. Exposed data included names, phone numbers and addresses. | fact | unsupported | none recorded |
| 9. For some customers, exposed data included birthdates and partial Social Security numbers. | fact | unsupported | none recorded |
| 10. The ShinyHunters extortion group gave ADT a 'pay or leak' deadline. | fact | unsupported | none recorded |
| 11. ADT's only public acknowledgment came four days after the deadline. | fact | unsupported | none recorded |
| 12. A lawsuit alleges ADT still hasn't told most affected customers exactly what data was taken. | fact | unsupported | none recorded |
| 13. ADT confirmed no payment cards, alarm-system access codes or camera audio/video were part of this breach. | fact | unsupported | none recorded |
0 of 13 claims have a confirmed source of their own.
Sources
| Source | Claim | Tier | Status | Quote |
|---|---|---|---|---|
| none | Claim 3 | Unassigned | not found | No quote recorded. Quote basis: not recorded. |
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy adt.com/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service adt.com/terms-of-use | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source https://www.bankinfosecurity.com/home-security-firm-adt-breach-55m-customers-data-exposed-a-31511 Verification: Verified - primary source confirmed | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.