Aura, an identity protection and digital safety company, has confirmed a data breach affecting approximately 900,000 records from a marketing database associated with a previously acquired company. A targeted voice phishing, or vishing, attack on one of Aura’s employees allowed unauthorized access to the database, which contained names, email addresses, phone numbers, home addresses, IP addresses, and customer service notes.
Fewer than 20,000 active Aura customers and fewer than 15,000 former customers were affected. No Social Security numbers, passwords, financial information, credit records, or core identity theft protection database records were compromised, according to the company. Aura did not disclose the timing of the breach or the timing of its discovery. The ShinyHunters threat group advertised the stolen data before the company’s own public disclosure.
The breach follows a rising tide of identity breaches driven by social engineering, with help desk impersonation identified as the leading identity-based attack vector. Aura’s incident also echoes the DoorDash breach caused by social engineering, where a similar manipulation technique exposed contact data for millions of users.
On the same day, security research firm Oversecured published findings from an evaluation of 17 popular Android AI companion applications with more than 150 million combined installations. The research identified 14 critical vulnerabilities and 311 high-severity issues across the apps. Ten of the 17 contained flaws capable of exposing users’ full conversation histories. Six of those applications could leak explicit sexual content, mental health disclosures, and other highly sensitive personal information disclosed by users during conversations.
Oversecured researchers identified several distinct classes of vulnerability: hardcoded cloud credentials embedded in application code, cross-site scripting exploits that enabled arbitrary code injection into chat interfaces, and file theft vulnerabilities that allowed unauthorized access to stored user data. The AI companion apps are designed to facilitate intimate, personal conversations, including discussions of relationships, mental health, and grief, meaning the consequences of data exposure extend well beyond typical contact record leaks.
Oversecured did not name the specific applications affected in its public disclosure, though it noted the affected apps account for more than 150 million installations on the Android platform alone.
Sources: Bleeping Computer, Cybernews
–
By Ji-seo Kim
