Social EngineeringTechnologyProfessional ServicesInformationVishingStolen CredentialsRansomwareShiny HuntersData ExfiltratedRansom DemandedCustomer Data InvolvedMulti-Stage ChainIdentity (basic)Government IDCriticalContained

ADT Inc.

bd_e094ffa4469f3766 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Apr 20, 2026

Filed

Jul 29, 2026

To disclose

14 weeks

Affected · nationwide

331,536702 in this filing

Linked

8 filings

Confidence

66%

Full breach record for ADT Inc. →4 incidents on file

ADT LLC reported unauthorized access to its Salesforce database on April 20, 2026, by the threat actor 'Shiny Hunters'. The attackers manipulated an employee via vishing to obtain Okta credentials. The incident affected 331,536 individuals nationwide, including 702 New Hampshire residents. Exposed data included names, emails, phone numbers, addresses, dates of birth, and last four digits of SSNs or Tax IDs. Data was exfiltrated and a ransom demand was issued. ADT contained the breach, notified law enforcement, and is offering credit monitoring services.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d14 weeks discovery → filing

Incident timeline

discovery → filing · 14 weeks / 100 days

Apr 20, 2026

Begins

Apr 20, 2026

Discovered

Jul 29, 2026

Filed

vs. sector median

4 wks faster

This filing is one of 8 about the same incident.View merged incident

A leak claim by shinyhunters about this victim predates this filing by 95 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitelockbit5bd_9bb50e8a639885802026-08-23 · +25dVerified by operator
Leak Siteshinyhuntersbd_6a819d19e886ff232026-04-24 · +96dVerified by operator

Regulatory filings (5) · sorted by filing gap

Texas State AGbd_398dec1b429ee6f92026-07-28 · +1dVerified by operator
Washington State AGbd_7c187a828ecd79882026-07-28 · +1dVerified
Oregon State AGbd_a3390e1fa5a8ee7e2026-07-28 · +1dVerified by operator
Massachusetts State AGbd_aef18852e33a482b2026-07-27 · +2dVerified by operator

Show 1 more filing ↓up to 96d gap

Delaware State AGbd_d1b54352257f31562026-04-24 · +96dVerified by operator

Name: ADT Inc.
norm: adt
Domain: adt.com

Name: ADT Inc.
norm: adt
Domain: adt.com
Industry: TechnologyllmProfessional Servicesllm

Discovered: Apr 20, 2026
Breach occurred: Apr 20, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 24, 2026
Affected individuals: 331,536state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Phishing· Shiny Hunters
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1041 Exfiltration Over C2 ChannelT1486 Data Encrypted for Impact
Threat actor: Shiny HuntersExternalFinancial
Regulator citations: Submitted notice to Office of the New Hampshire Attorney GeneralFiled Form 8-K with the Security and Exchange Commission
Initial access: phishing_link

During the incident: Activated response protocols immediately to terminate the unauthorized access
Launched a forensic investigation with leading third-party cybersecurity experts
Notified law enforcement
Published a general notice about the incident on April 24, 2026
Began sending emails to designated individuals on April 24, 2026
Filed a Form 8-K with the Security and Exchange Commission
Offering individuals complimentary identity protection services
Changes made: Providing access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge for twelve (12) months
Providing proactive fraud assistance through Cyberscout
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(100 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Delaware State AGApr 24 · first

Massachusetts State AG+94d

Texas State AG+95d

Washington State AG+95d

Oregon State AG+95d

New Hampshire State AG+96d · this page

Pattern: first filing Apr 24 (DE), last Jul 29 (NH) — a 96-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/adt-20260729.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 29, 2026
Raw hash: aec8c21d01697acbcd175e70c6429109a1019addeb7e091bf0f1080be1d160c2

Linked disclosures

Ransomware claims (2)

Regulatory filings (5) · sorted by filing gap

Reporting entityADT Inc.

Victim entityADT Inc.

Incidentdiscovered Apr 20, 2026

Stated responseActivated response protocols immediately to terminate the unauthorized access

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov