Aura data breach: 903K accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2026-03-18
In March 2026, the online safety service Aura disclosed a data breach that exposed 900k unique email addresses. The data was primarily associated with a marketing tool from a previously acquired company, with fewer than 20k active Aura customers affected. Exposed data included names, phone numbers, physical and IP addresses, and customer service notes. Aura advised that no Social Security numbers, passwords or financial information were compromised. Exposed data: customer service records, email addresses, ip addresses, names, phone numbers, physical addresses. The breach dates from Mar 6, 2026; Have I Been Pwned loaded it on Mar 18, 2026.
What to do
- If you had a Aura account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
