Security · Data · Smart Home

5.5 Million People Learned Their Alarm Company Was the Weak Point

SMARTS · 19 August 2026 · 12 min read

On 20 April 2026, ADT — the company whose entire proposition is that your home is hard to get into — detected unauthorized access to its customer data. It disclosed the incident on 24 April, per the company’s own statement. Three days later, BleepingComputer reported the scale: data on 5.5 million people — names, email addresses, dates of birth, phone numbers and physical addresses. The alarm company had been broken into. Not the house. The database. And for a security company, the database is the worse door.

The Feeling First

They Had the Address of Every Door

The particular dread of a security-company breach is that the data is not anonymous telemetry. It is coordinates. BleepingComputer’s reporting places physical addresses and phone numbers among the exposed fields, alongside names, email addresses and dates of birth, per BleepingComputer. That is precisely the dataset a burglar, or a social engineer calling to “confirm your alarm plan,” would want: a list of homes, their alarm-company relationships, and the phone numbers attached to them. You paid the company to be the wall. The wall kept a list, and the list leaked.

The alleged mechanics sharpen the discomfort. The lawsuit’s account, per Thomson Reuters’ Westlaw, blames ShinyHunters, which allegedly accessed the data after compromising an employee’s Okta single sign-on account; Mashable‘s coverage describes the same episode as a phishing hack netting 5.5 million emails. One employee’s credentials, either way — not a vault cracked, but a door left ajar in the access architecture. The breach did not require defeating the security product. It required the company’s own internal locks to fail, which is a colder thought than any forced entry.

ADT sells the feeling of being watched over. The breach converts that feeling into its opposite: the knowledge that the watcher was watched, and that the record of where you live is now circulating in a market that does not care about your peace of mind. The breach is recorded in the Have I Been Pwned database, where anyone can check whether their own address appears, per Have I Been Pwned. That is the service the alarm company’s customers now need: a lookup tool, from a stranger, to find out whether the company that promised to protect them gave their location away.

The Market

Security Hardware, Consumer Data, and the Regulators Who Noticed

The incident itself has a known shape. ADT’s breach has been attributed to ShinyHunters in what has been described as a “pay or leak” extortion, and it is recorded in the Have I Been Pwned breach database, per Have I Been Pwned. The word “extortion” matters: the arrangement assumes the data will circulate whether or not anyone pays, which is the correct assumption for everyone downstream to make.

The wider pattern is that regulators have begun treating security-device claims as consumer-protection matters. The New York Attorney General secured a $450,000 settlement over eufy home security camera security concerns, per the Hunton Privacy & Cybersecurity Law Blog. A camera company’s security promises are now the subject of state enforcement, and the same logic reaches the monitoring industry’s promises about its data. In California, the Consumer Reports-backed SB 898 would require support-period transparency for connected consumer products, per Consumer Reports — another turn of the same screw: what a vendor promises, a vendor must disclose and defend. The public is ahead of the statute books: 72 percent of Americans with smart devices say they want mandatory support-duration disclosure, per Consumer Reports, US PIRG and the Secure Resilient Future Foundation.

And the direction of travel on disclosure speed is now written into law across the Atlantic. The EU Cyber Resilience Act entered into force on 10 December 2024, per Cavli Wireless’ compliance guide. From 11 September 2026, manufacturers must report actively exploited vulnerabilities within 24 hours, per Taylor Wessing, and the duty covers exploited vulnerabilities and security flaws in connected consumer devices, per Dentons. The Act’s main obligations apply from 11 December 2027, per the European Commission, and Crowell & Moring has called the September reporting provision among the most operationally demanding. In New York, meanwhile, Senate Bill S.9267 passed the Senate 41–20 on 2 June 2026, requiring opt-in for coordinated monitoring and capping retention at 72 hours for non-subscription devices, per the New York State Senate. The monitoring industry’s data practices are being legislated from both ends: how much you may collect, and how fast you must speak when it leaks.

The Pain

You Cannot Un-Install Your Address

1. The dataset is the attack surface. For a security company, the customer database is the crown jewel and the fatal flaw at once: names, email addresses, dates of birth, phone numbers and physical addresses, per BleepingComputer. A burglar with a monitoring company’s records knows which homes are monitored and by whom. A social engineer with your address and phone number can call you and sound exactly like the company that protects you. The breach does not simply expose data; it converts the vendor’s core asset into the criminal’s map, and the map is of real houses.

2. The disclosure window. ADT detected the unauthorized access on 20 April and disclosed on 24 April, per ADT’s statement. Four days is fast by industry norms, and it deserves to be said plainly. But the gap between detection and disclosure is the interval in which stolen data is worked — sold, merged, rehearsed — and every day of it is a day the affected person does not know to be careful. The EU’s answer, from 11 September 2026, is 24 hours for actively exploited vulnerabilities, per Taylor Wessing. The ADT timeline is the argument for why that rule exists.

3. You cannot un-hand the data. Monitoring is structurally unable to work without your address and your phone number; the alarm must know where to send help, and the phone is how it calls. That trade is unavoidable, which makes every other field a matter of choice. Dates of birth, secondary emails, payment details — each is another key to the same door. Have I Been Pwned can tell you whether the data has surfaced, per Have I Been Pwned, but no lookup tool can unsend it. The only real lever is at signing time, and it is called minimization.

The Numbers

5.5 Million People, and the Precedent Behind Them

The central figure is 5.5 million people, per BleepingComputer, and it is corroborated in separate coverage: Mashable reports the hack netted 5.5 million emails, and the breach tracker ClaimDepot logs 5.5 million records. Beside that number sits the company’s own characterization — “a limited set of customer and prospective customer data,” per ADT’s statement. These are different claims from different vantage points: the press is counting people, the company is describing the set. Both are on the record, and the honest reader holds both rather than collapsing them into a single figure. Some class-action trackers go further still, describing partial Social Security numbers among the exposed data, per ClassActionU — a detail that does not appear in BleepingComputer’s field list, and where sources differ, both are reported.

The litigation clock is running. A class action was filed on 12 May 2026, per Ginsburg Law Group, and Westlaw‘s account of the suit, published 30 April, alleges that ADT’s failure to protect customer data led to the breach and that ShinyHunters accessed the data through a compromised employee single sign-on account. Allegations, at this stage — the operative word in any honest reading of the docket.

The regulatory numbers run on a different clock. The New York Attorney General’s eufy settlement was $450,000, per Hunton. The EU Cyber Resilience Act applies its reporting obligations from 11 September 2026 — 24 hours for actively exploited vulnerabilities, per Taylor Wessing — with full application from 11 December 2027, per the European Commission and Crowell & Moring. The pattern across the jurisdictions: the figure that matters is no longer just how many records leaked, but how many hours elapsed before the company said so.

The Buy

What to Ask Before You Hand Over Your Floor Plan

1. Ask what data is collected, and why. Address and phone number are load-bearing for monitoring — the alarm must know where to send help and how to call it. Dates of birth are not load-bearing. The ADT field list — names, emails, dates of birth, phone numbers, physical addresses, per BleepingComputer — is the menu of what monitoring companies consider fair game. Treat every field beyond the operational minimum as an unnecessary key to your front door, and ask whether the plan can be structured with a smaller footprint.

2. Audit the vendor’s breach history and disclosure behaviour. The benchmark is now concrete. ADT detected on 20 April and disclosed on 24 April, per ADT; from 11 September, vendors selling connected devices in the EU must report actively exploited vulnerabilities within 24 hours, per Taylor Wessing. Ask a prospective vendor, in writing: how fast did you tell your customers the last time something happened, and what is your policy for the next time? Check Have I Been Pwned to see whether your own data has already surfaced.

3. Treat disclosure speed as a spec, not a courtesy. The Cyber Resilience Act’s 24-hour reporting duty, per Taylor Wessing, applies to exploited vulnerabilities and security flaws in connected consumer devices, per Dentons. A vendor that meets that duty in Europe can meet it for you. If a salesperson cannot answer the disclosure question in minutes, they have told you their posture already.

4. Read the retention and support clauses. New York’s S.9267, which passed the Senate 41–20 in June, caps retention at 72 hours for non-subscription devices and requires opt-in for coordinated monitoring, per the New York State Senate — a working definition of what is considered defensible. Ask how long your provider keeps footage, records and call logs, what happens to them when you cancel, and how long the hardware will receive security support. The Federal Trade Commission audited 184 connected-product pages and found only 21 disclosed software-support duration, per the FTC; California’s Consumer Reports-backed SB 898 would force the question, per Consumer Reports. Ask it anyway.

5. If you were among the 5.5 million: assume exposure, then act. Change passwords and alarm codes. Be alert for calls, texts or emails that use your address and phone number as proof of legitimacy — those fields, per BleepingComputer, are exactly the credentials a social engineer needs to sound like your alarm company. And do not wait for a confirmation letter: “pay or leak” extortion, per Have I Been Pwned, means the data may circulate whether or not anyone pays.

The Last Word

ADT’s statement, the press, the trackers and the complaint disagree about the size and shape of what leaked, and this article has kept those versions separate on purpose. What they agree on is the structure of the problem: the security industry sells you a lock and keeps a copy of the map. The breach did not create that risk; it itemized it. There is no monitoring company that has never been breached, and there never will be — the buyer’s task is to find the company that treats your address as what it is, the most dangerous thing it stores, and that tells you, in hours rather than weeks, when the store is broken into. The definition of “responsible” is being written right now, in Brussels and Albany. From 11 September, in Europe at least, 24 hours is the answer, per Taylor Wessing. You are allowed to ask for it earlier.

— THE SMARTS DESK

Sources

Research Appendix

Every statistic in this article links to its primary source. Full list, as of 19 August 2026: