ADT confirms customer data theft

ADT said on April 24 that hackers stole some customer and prospective customer data after breaking into certain cloud-based systems. (adt.com) The Boca Raton, Florida, company said it detected the unauthorized access on April 20 and cut off the intrusion the same day. ADT said it brought in third-party forensic investigators and notified law enforcement. (adt.com) (bleepingcomputer.com) ADT said the stolen information was “mostly” customer names, phone numbers, and addresses tied to a limited set of current and prospective customers. The company said home security system data, payment card data, and banking information were not accessed. (adt.com) (theverge.com) The case matters because ADT sells alarm systems, cameras, and monitoring built around trust in who can see household information. A leak of names, addresses, and phone numbers can still give criminals material for phishing, impersonation, or targeted scams. (adt.com) (securitymagazine.com) ADT did not say how many people were affected. That gap has become the central unanswered question in the company’s public account of the incident. (adt.com) (fox10phoenix.com) The hacking group ShinyHunters has claimed responsibility and said it stole 10 million records, but ADT has not confirmed that figure. Independent reports said the group threatened to leak the data unless a ransom was paid. (bleepingcomputer.com) (theverge.com) ADT is scheduled to report first-quarter 2026 results on April 30, three business days after the breach disclosure. That puts the incident in front of investors almost immediately, before the company has published a customer count or fuller forensic findings. (investor.adt.com) (newsroom.adt.com) The company has faced trust questions before. In 2020, ADT disclosed that a former technician had improperly accessed customer camera feeds, and the Federal Trade Commission later announced a settlement over security failures tied to that episode. (adt.com) (ftc.gov) For now, ADT’s public position is narrow: a limited set of personal data was taken, core security-system and financial data were not. The next test is whether the company can put a number, a timeline, and customer notices behind that claim. (adt.com)