ADT Suffers Data Breach, ‘ShinyHunters’ Hackers Say They Stole 10 Million Records

Home security provider ADT has experienced a data breach that seems to be linked to notorious hacking gang ShinyHunters, which is now trying to extort the company. 

ADT disclosed the breach today, a day after ShinyHunters threatened to leak the stolen information. “Over 10M records containing PII [personal identifying information] and other internal corporate data have been compromised. Pay or Leak,” the group said in a post on the dark web. 

This Tweet is currently unavailable. It might be loading or has been removed.

ADT didn’t say how many users were affected. But in a statement, the company said the breach was detected on Monday, April 20, and involves “a limited set of customer and prospective customer data.”

“The investigation confirmed that the information involved was limited to names, phone numbers, and addresses. In a small percentage of cases, dates of birth and the last four digits of Social Security numbers or Tax IDs were included. Critically, no payment information—including bank accounts or credit cards—was accessed, and customer security systems were not affected or compromised in any way,” the company said. 

In response, ADT terminated the intrusion, launched a forensic investigation with “leading third-party cybersecurity experts,” and notified law enforcement. The company says it also “directly notified all impacted individuals and will offer complimentary identity protection services as appropriate.”

It’s unclear how the hackers gained access. But ShinyHunters has been known to use English-language phone calls and impersonation to trick victims, or what’s known as voice phishing. This can involve pretending to be an IT customer support and manipulating an employee at a target company into handing over internal access. 

ShinyHunters has threatened to leak the stolen data if ADT doesn’t pay the ransom by Monday. So, affected customers should be on guard since the pilfered information could expose them to phishing attacks and identity theft schemes. 

ADT experienced two other security incidents in 2024.

About Our Expert

Michael Kan

Principal Reporter

---

Experience

I’ve been a journalist for over 15 years. I got my start as a schools and cities reporter in Kansas City and joined PCMag in 2017, where I cover satellite internet services, cybersecurity, PC hardware, and more. I’m currently based in San Francisco, but previously spent over five years in China, covering the country’s technology sector.

Since 2020, I’ve covered the launch and explosive growth of SpaceX’s Starlink satellite internet service, writing 600+ stories on availability and feature launches, but also the regulatory battles over the expansion of satellite constellations, fights with rival providers like AST SpaceMobile and Amazon, and the effort to expand into satellite-based mobile service. I’ve combed through FCC filings for the latest news and driven to remote corners of California to test Starlink’s cellular service.

I also cover cyber threats, from ransomware gangs to the emergence of AI-based malware. In 2024 and 2025, the FTC forced Avast to pay consumers $16.5 million for secretly harvesting and selling their personal information to third-party clients, as revealed in my joint investigation with Motherboard.

I also cover the PC graphics card market. Pandemic-era shortages led me to camp out in front of a Best Buy to get an RTX 3000. I’m now following how the AI-driven memory shortage is impacting the entire consumer electronics market. I’m always eager to learn more, so please jump in the comments with feedback and send me tips.

Read Full Bio