Aura breach: vishing call exposed ~900,000 records in an acquired firm's marketing tool
One vishing call gave attackers an hour in an Aura employee account and about 900,000 marketing records. What went wrong and how to harden SaaS access.
In March 2026, identity-protection company Aura confirmed that an attacker reached about 900,000 records after phoning one of its employees. The data came from a marketing tool used by a company Aura had acquired five years earlier, not from Aura's core product. Two lessons for engineering teams: SaaS tools picked up through acquisitions are often the least protected part of the estate, and a phone call can get past controls built to stop phishing emails.
What happened
According to Aura's statement, an employee was targeted in a voice phishing (vishing) attack, and an unauthorised party then had access to that employee's account for about an hour before Aura cut it off. In that time the attacker reached roughly 900,000 records in a marketing tool belonging to a company Aura acquired in 2021. Aura says the vast majority were names and email addresses, and some included home addresses and phone numbers. It believes fewer than 20,000 active and fewer than 15,000 former Aura customers were among them.
Aura says no Social Security numbers, passwords, payment details or credit files were exposed. A 19 March update added that no database supporting the Aura identity theft protection app was accessed. The company activated its incident response plan, brought in outside security and legal experts, notified law enforcement and began notifying customers.
The extortion group ShinyHunters listed Aura on its leak site, said it had stolen more than 900,000 records of PII and corporate data, and published about 12 GB. Have I Been Pwned added the breach on 18 March with about 903,000 email addresses. HIBP's listing also includes IP addresses and customer service records.
Who is affected
- People whose contact details were held in the acquired company's marketing tool, including current and former Aura customers.
- Any organisation that runs CRM or marketing platforms reachable with a single employee login. ShinyHunters spent this period going after SaaS data stores, often Salesforce instances, at many companies.
What it means for developers and engineering teams
Vishing gets around email defences. The current ShinyHunters playbook uses phone calls posing as IT support to get an employee to approve an MFA prompt, read out a code, or authorise a connected app through a device-code or OAuth flow. Email filtering and link scanning don't see any of it. Only phishing-resistant authentication and tight app-authorisation policies stop it.
Acquisitions bring in weaker SaaS setups. Tools from an acquired company often keep their old access model: broad roles, no SSO enforcement, and data nobody has reviewed since the deal closed. Folding them into corporate SSO without reviewing their data and permissions leaves a large, poorly governed store one login away.
An hour is enough time. With API access or bulk export, an attacker can pull hundreds of thousands of rows in minutes. Detection that runs in daily batches will report the breach after it is over.
Retention is a security control. Records from former customers and old marketing lists add to breach impact without adding much business value.
What to do now
- Use phishing-resistant MFA (FIDO2 passkeys or security keys) for any account that can reach customer data, and turn off push and SMS fallbacks where you can.
- Restrict connected apps: in Salesforce and similar platforms, only allow admin-approved connected apps, and block device-code or OAuth grants to unknown clients.
- Alert on bulk reads and exports in real time, for example report exports, Bulk API jobs, or a sudden spike in query rows from one user.
- Review SaaS tools from acquisitions: who has access, what data they hold, whether SSO is enforced, and whether the tool is still needed at all.
- Apply retention rules to marketing and CRM data, and delete or archive contacts you no longer have a reason to keep.
- Write a help-desk verification script and teach staff that real IT support will never ask them to read out a code or approve a prompt they didn't trigger.