ADT disclosed a breach in late April 2026 affecting 5.5 million customers. The threat actor was ShinyHunters, the same group behind dozens of high-profile breaches including Ticketmaster and Santander. The entry point was a single ADT employee, socially engineered over the phone into handing over their Okta single sign-on credentials. One phone call. One employee. 5.5 million records.
How the Okta SSO Attack Pattern Works
ShinyHunters has refined this approach across multiple enterprise targets. The playbook is consistent enough that it qualifies as a repeatable TTPs pattern rather than a one-off opportunistic attack.
The attacker researches the target company to identify which SSO platform they use. Okta dominates enterprise deployments, so it is the most common target, but the same pattern applies against Microsoft Entra ID, Ping Identity, and others. Once the SSO provider is confirmed, the attacker social engineers an employee with broad application access, typically in IT support, sales operations, or HR. These roles tend to have wide Okta access because they manage accounts or assist users across many applications.
The vishing call typically impersonates IT support or a vendor. The pretext varies: "we're seeing unusual login activity on your account and need to verify your credentials," or "we're rolling out a security update and need to confirm your current password to migrate your account." Employees with no specific security training on social engineering tactics are susceptible because the call sounds entirely plausible.
The Secondary Risk Nobody Is Talking About
Most breach coverage focuses on identity theft and spam. For ADT customers, there is a more immediate concern: the stolen data includes home addresses linked to ADT security service accounts. This tells anyone with the database which homes have a security system (and by extension, which homes might be better protected than average), which addresses are ADT customers (enabling targeted fraud impersonating ADT), and when combined with social media or public records, roughly when customers might be traveling or away.
Customer address data from a home security company is not just useful for phishing. It identifies which households have alarm systems, creates a targeting list for criminals impersonating ADT technicians, and can be cross-referenced against booking or travel data to identify when customers are away from home.
ADT customers should be alert for any contact from someone claiming to be ADT requesting entry, scheduling service, or asking for payment. The data is in criminal hands and that risk persists for years, not weeks.
What Organizations Should Take From This
Okta and similar SSO platforms are architected correctly. The breach was not an Okta vulnerability. It was a human vulnerability. SSO centralizes authentication in a way that improves security posture in aggregate, but it creates a single high-value target. Compromise one account with broad access and you get an authenticated session into every connected application simultaneously.
Three controls matter most for defending against this pattern:
- Phishing-resistant MFA: Hardware security keys (FIDO2/WebAuthn) or passkeys cannot be handed over in a voice call. Push-based MFA can be manipulated via MFA fatigue or social engineering. TOTP codes can be verbally disclosed. Hardware keys cannot.
- Okta access reviews: Employees accumulate application access over time. Regular access reviews should remove applications an employee no longer needs. The attack surface shrinks proportionally.
- Vishing-specific security awareness: Generic phishing training does not cover phone social engineering. Employees should have explicit guidance: IT will never ask for your password or MFA code over the phone. Period.
ADT will not be the last company breached via this path. ShinyHunters is still operating. The playbook is proven and repeatable.
Is Your SSO Infrastructure Resistant to Vishing?
RedEye Security tests your authentication controls, MFA configuration, and employee resistance to social engineering attacks targeting SSO credentials.
Request an Assessment