ADT's April 2026 Cloud Breach and the Class Actions That Followed

ADT Inc. told the SEC it learned on April 20, 2026 that intruders had reached "certain cloud-based environments," then confirmed days later that the extortion group ShinyHunters had taken customer data; an independent count puts the exposure at 5.5 million unique email addresses, and at least two proposed class actions followed in federal court.

What ADT's own filing says

ADT's Form 8-K, filed April 24, 2026 under Item 8.01, says the company on April 20, 2026. The company says it moved to end the access, activated its incident response plan, brought in outside cybersecurity specialists, and notified law enforcement. Its investigation at the time of filing had found that only . On materiality, the filing states ADT does not currently believe the incident is reasonably likely to have a material effect on its financial condition or operations, while noting it continues to assess the incident's scope.

ADT's own public statement, reported by BleepingComputer, narrows what was taken: personal information , with also including dates of birth and the last four digits of Social Security numbers or tax IDs. ADT says no payment information was accessed and that customer security systems were not affected.

The extortion claim and how many people were affected

ADT has not itself published a company-wide affected count. ShinyHunters listed ADT on its leak site claiming , a figure ADT has not confirmed. The group told BleepingComputer it got in by vishing (voice-phishing) an ADT employee's Okta single sign-on account, then pulled data from the company's Salesforce instance; ADT has not confirmed how the intruders gained access.

An independent count gives a smaller, verified figure: Have I Been Pwned's own breach page says the incident , alongside names, phone numbers, physical addresses, dates of birth and, in a smaller share of records, partial government-issued ID numbers. The leak site's extortion deadline was April 27, 2026; ShinyHunters says it published an archive of the data after that date passed.

The class actions

At least two proposed class actions naming ADT as a defendant were filed in the U.S. District Court for the Southern District of Florida within weeks of the disclosure. Bloomberg Law reported that Maurice Beckwith filed a proposed class action around April 28, 2026, whose complaint alleges , making it vulnerable to the intrusion, and that the ShinyHunters group used an employee's compromised login, obtained through vishing, to reach the data. A second complaint, filed May 12, 2026 and tracked by OpenClassActions.com, raises claims including a failure to use reasonable security safeguards and a failure to guard against a foreseeable social-engineering attack, and seeks extended credit-monitoring coverage for the proposed class. Both actions are at the pleading stage; neither source reviewed for this page reports a ruling, consolidation order, or settlement.

What isn't on the record

No source checked for this page gives a company-confirmed, company-wide total distinct from the independently counted 5.5 million email addresses and the attacker's own unverified 10-million-record claim. ADT has not disclosed exactly how the intruders obtained the employee credential ShinyHunters describes. No settlement, dismissal, or ruling in either proposed class action turned up in this run's sources, and this page names no individual at ADT as responsible for the incident. ADT has no security-leadership record yet on CISO Tribune, the network's mothership site.

FAQ

What happened in the ADT data breach? ADT told the SEC that on April 20, 2026 it found unauthorized access to some of its cloud-based environments; the extortion group ShinyHunters said it took customer data by compromising an employee's single sign-on account through a vishing call, then pulling records from ADT's Salesforce instance.

How many people were affected by the ADT data breach? ADT has not published its own total. Have I Been Pwned's independent review found 5.5 million unique email addresses exposed, along with names, phone numbers, addresses and, for some records, dates of birth and partial Social Security or tax ID numbers; ShinyHunters claims more than 10 million records, a figure ADT has not confirmed.

Did ShinyHunters leak the stolen ADT data? The group's leak site set an April 27, 2026 deadline for payment before publishing the data; ShinyHunters says it released an archive after that deadline passed.

Did customers bring legal claims over the ADT breach? At least two proposed class actions naming ADT as a defendant were filed in the Southern District of Florida in April and May 2026, alleging failures to encrypt customer data and to guard against a foreseeable social-engineering attack; no ruling or settlement was found on the record as of this page's publication.

For more companies with both a disclosed incident and related litigation, see the data-breach class-action litigation tracker and the breach outcomes cross-reference.