You cannot make this up.
Aura is one of the largest identity theft protection companies in the United States. Over a million customers pay them a monthly fee to monitor their personal data, alert them to threats, and keep their identities safe from hackers. Their website is full of reassuring language about advanced security, real-time monitoring, and keeping you one step ahead of cybercriminals. In March 2026, a hacking group called ShinyHunters breached Aura’s systems by making a phone call.
That is not a typo. A single social engineering call to one Aura employee was all it took. The attacker impersonated a trusted contact, asked for system access, and the employee handed it over. No sophisticated zero-day exploit. No nation-state hacking tool. Just a convincing voice on the other end of a phone line. In roughly sixty minutes — one hour — ShinyHunters pulled 900,000 records from Aura’s internal systems. Names, email addresses, home addresses, and phone numbers. The kind of data that identity thieves use to build profiles, craft targeted phishing attacks, and steal identities. Exactly the kind of data Aura is paid to protect.
When Aura refused to pay the ransom, ShinyHunters did what they always do. They dumped 12 GB of stolen data on their public leak site for anyone to download. ShinyHunters is not new to this game. They operate on a simple model: steal data, demand payment, publish if ignored. They have been linked to breaches at dozens of major companies over the past several years. Aura was just another name on the list.
Aura’s official response was measured. They said fewer than 20,000 active customers and 15,000 former customers had contact information exposed. The majority of the 900,000 records, they explained, were marketing contacts inherited from a company Aura acquired back in 2021. No Social Security numbers, no passwords, no financial data were part of the breach, according to the company. The subtext was clear: this was not that bad.
But that framing misses the real story. Whether it was 20,000 customers or 900,000 records, the breach happened. A company that sells security as its core product was compromised through one of the oldest tricks in the book. Social engineering is not a new attack vector. It is one of the first things any security company should train its employees to resist. If Aura’s own staff are vulnerable to a phone call, what does that say about the systems protecting your data?
This is the fundamental problem with centralized cloud services holding sensitive data. It does not matter how many layers of encryption you advertise, how many trust badges you put on your website, or how slick your dashboard looks. When all of your customers’ data lives in one place, the entire system is only as strong as its weakest human link. One bad decision by one employee on one afternoon, and the vault door swings open.
And this is not a one-off. Cloud-based services holding sensitive personal data are breached with alarming regularity. The business model itself creates the incentive for attackers. Why spend weeks trying to hack one person’s device when you can hack one company and get a million people’s data in a single afternoon? Centralized data is a centralized target. The payoff is massive because it is everyone’s data at once.
The irony here is thick enough to cut with a knife. Aura’s customers signed up specifically because they were worried about their personal data being exposed. They paid a monthly fee for peace of mind. And now their names, emails, home addresses, and phone numbers are sitting on a public leak site because the company they trusted to protect them got beaten by a phone call.
At Cloudless Software, we have always believed that your sensitive data belongs on your device, under your control. Not on someone else’s server, guarded by someone else’s employees, vulnerable to someone else’s mistakes. When data stays local, there is no centralized honeypot to attack, no million-record jackpot to chase, and no single point of failure that takes everyone down at once. Your data, your device, your control.
