Aura data breach 2026: What happened and what you need to know

How did the Aura data breach happen?

Aura announced a security incident on March 17, 2026. In its account of what happened, the company described a targeted phishing attack against one employee. The attacker gained access to that person’s corporate account for about an hour before Aura’s security team removed them.

Aura says most of the exposed information came from marketing records at Circle Media Labs, a company Aura acquired in 2021. Those records included contact details for people who later became Aura customers.

The employee’s account had access to marketing information but not to the systems supporting Aura’s identity protection app. That limited what the intruder could reach through the compromised account. According to Aura, the app and the sensitive customer information it held remained secure throughout the data breach.

What data was compromised during the Aura data breach?

Aura’s disclosure identifies the information found in the exposed marketing records. Some records contained more details than others, so the information involved in an individual customer’s case may differ from the list below.

What data was exposed?

According to Aura, the exposed records included:

• Names and email addresses.
• In some cases, home addresses, phone numbers, and IP addresses.

The company says fewer than 20,000 active Aura customers were affected. These customers had previously provided information to Circle.

Aura also said 90% of the exposed email addresses had appeared in earlier, unrelated breaches. That figure refers specifically to email addresses. It does not establish whether the other details in a record, such as a phone number or home address, had been exposed before.

If you are an Aura customer, the notification issued by the companies should help clarify which details were involved in your case.

What data was not exposed?

Aura says the incident did not compromise:

• Social Security numbers (SSNs).
• Passwords.
• Financial information.
• Credit records.

What to do if your data was exposed in the Aura breach

If Aura tells you that your information was affected, treat any unexpected message about the incident with caution. Aura advises customers to use its official website or app rather than rely on links or instructions sent in an unsolicited email or text.

If someone contacts you claiming to represent Aura, verify the communication before sharing any personal information. Open the Aura app yourself or type the company’s website address directly into your browser instead of following a link in the message. The same rule applies to unexpected phone calls: Do not provide information until you have confirmed that the caller is legitimate through an official Aura channel.

Aura also says suspicious communication can be reported to its support team.

Finally, read any breach notification from Aura carefully. The company says it is contacting affected customers as it reviews the exposed records, so the notice should help establish whether your information was involved and what information was affected.

What to do if your identity theft protection provider is breached

If you suspect that you have been affected by a data breach, ask the service provider to identify the affected data and explain its response. In its update, Aura reports that it:

• Removed the intruder from the employee’s account.
• Was working with outside cybersecurity specialists.
• Was matching the exposed data against its records.
• Was notifying affected Aura customers.

The impact of a data breach on individuals depends partly on the information involved. When deciding what to do if your data has been breached, match your response to the details in your notice.

Keep that notice alongside correspondence and records of any losses. If you later seek advice about data breach compensation, those documents can help you explain what happened. A breach announcement alone gives you no basis to assume that a payment is available.

How to protect your personal information in the future

Your personal information is spread across a variety of services you use every day. Protecting those accounts consistently can reduce the risk of future exposure and make stolen details harder to misuse.

• Avoid links from unknown or untrusted sources, which may lead to phishing pages or malicious websites. Be suspicious of urgent requests and unexpected offers, especially messages asking for personal information or login credentials. Verify requests through the company’s official website or app.
• Protect each account with a strong, unique password. A password manager can help you generate and securely store them. Enable two-factor authentication (2FA) to add another layer of security.
• Keep your devices, apps, browsers, and security software updated to fix known vulnerabilities. Turn on automatic updates where available.
• Review login activity and security alerts regularly for unfamiliar access. Check security settings for unauthorized changes, and remove permissions for connected apps you no longer use.
• For ongoing checks for personal information exposed on the dark web, set up dark web monitoring. Choose a service that sends alerts when your details appear in known leaks or exposed databases within its coverage.