Aura aura.com Aura data breach: what happened and what to do
Have I Been Pwned lists an Aura breach from 6 March 2026 covering 903,080 accounts. Exposed: names, email addresses, phone numbers, physical addresses, IP addresses and customer service records. Aura said it came from a marketing platform, not its core systems.
View all 13,115 breaches- Breach date
- 6 Mar 2026
- Affected
- 903,080
- Data exposed
- Customer service records, Email addresses, IP addresses, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Have I Been Pwned (HIBP) dates the Aura breach to 6 March 2026 and added it to its database on 18 March 2026. It lists 903,080 accounts. Aura, the identity protection company, confirmed the incident and said that a voice phishing attack on an employee gave attackers access to a marketing platform it inherited through a 2021 acquisition. The company said its core account systems were not involved.
According to Aura's statement as reported by Bitdefender and others, about 901,000 records were exposed, but only around 35,000 of them belonged to Aura customers: roughly 20,000 current and 15,000 former customers. The rest came from the legacy database of the acquired company, mostly marketing contacts. The ShinyHunters group claimed responsibility and, according to news coverage, published the data after Aura declined to pay.
HIBP notes that around 90% of the exposed email addresses had already appeared in earlier breaches. That is a common pattern with marketing lists.
What was exposed
HIBP lists customer service records, email addresses, IP addresses, names, phone numbers and physical addresses. Aura said Social Security numbers, passwords and financial details were not accessed. Customer service records are free-text notes from support conversations, so they can hold details that people shared when they asked for help.
Why it matters
The irony of an identity protection company being breached makes headlines. The practical risk is the same as for any contact-details leak: scams that use your name, number and address.
A message that says it comes from your identity protection provider, about a breach alert or a billing problem, is exactly what a criminal would send to people on this list. It sounds routine, and it asks you to log in or call a number. If you are an Aura customer, or were one, expect those messages. If you were only in the marketing database, you may never have heard of the company holding your data, which is its own problem: the data sat in an old system nobody on your side knew about.
IP addresses are a smaller concern. They reveal roughly where you live and who provides your internet, and they can be matched with other leaked data. They don't give anyone access to your home network.
Aura's response
Aura said it was working with outside cybersecurity experts, had notified law enforcement and would send personal notifications to affected individuals within days of its announcement. Aura's statement describes the passwords and financial data as not accessed. If you receive a notice, check that the sender's address is on the company's own domain.
Are you affected?
Check your email address on HIBP. If it appears, the details above were exposed, and you should think about phishing first. The 90% overlap with earlier breaches also means your address may already be on several lists, which makes the steps below worth doing whatever this entry says.
What to do if you were in it
- 1
Be suspicious of 'security alert' messages
Emails, texts and calls claiming to be from an identity protection or security company are a favorite scam format right after a breach. Don't click the link. Log in through the official app or by typing the website address.
- 2
Don't give codes or passwords to callers
The attack on Aura started with a phone call to an employee. No real company asks you to read out a one-time code. Hang up and call back on a number you looked up yourself.
- 3
Change reused passwords and turn on 2FA
Passwords aren't listed as exposed here. Since most of these email addresses were in earlier breaches, change any password you have reused and use an authenticator app where possible.
- 4
Keep an eye on mail and calls
Your address and phone number are listed. A rise in spam calls, texts or junk mail can show where your data has spread.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at https://www.serus.ai. Serus monitors breach databases and the dark web and alerts you when your data appears, so you hear about the next one without searching for it.
Frequently asked
Was I affected by the Aura data breach?
Check your email address on Have I Been Pwned or run a free Serus scan. Aura also said it would notify affected individuals directly.
What data was exposed in the Aura breach?
Have I Been Pwned lists customer service records, email addresses, IP addresses, names, phone numbers and physical addresses. Aura said Social Security numbers, passwords and financial details were not accessed.
Were these Aura customers?
Aura said about 35,000 of the roughly 901,000 records belonged to Aura customers, and the rest were marketing contacts from a company it acquired in 2021.
Should I change my password?
Passwords are not listed as exposed. Change any password you have reused across sites, which is good practice after any breach.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
