Aura, an identity safety firm, has verified that an unauthorized individual accessed almost 900,000 customer records, including names and email addresses.

The company explained that the breach occurred due to a voice phishing attack on an employee, jeopardizing the private data of 20,000 current and 15,000 past clients.

In a statement released this week, Aura reports that the compromised data came from a marketing platform used by a company Aura acquired in 2021, and exposed minimal data.

Aura is a digital safety business providing services like identity theft defense, credit and fraud monitoring, and online safety features for phishing protection, marketing itself as a comprehensive online protection solution.

Earlier this week, the ShinyHunters threat group took responsibility for the attack on their data leak site, claiming to have stolen 12GB of customer PII, as well as company data.

The attackers released the stolen data, stating that the company “failed to reach an agreement with them despite all the chances and offers” they gave.

Aura states that the stolen customer data includes full names, email addresses, physical addresses, and phone numbers. The firm emphasizes that Social Security Numbers (SSNs), passwords, and financial data were not exposed.

The Have I Been Pwned (HIBP) service analyzed the leaked information and included it in its database, mentioning that customer support comments and IP addresses were also compromised. HIBP also mentioned that 90% of the email addresses involved had already been compromised in previous security incidents.

BleepingComputer inquired about the discrepancy between HIBP’s report of slightly over 901,000 compromised accounts, and Aura confirmed its own reported number.

This is because the data obtained via the marketing tool originated from the company acquisition in 2021. However, the database included only 35,000 Aura customers. The business declined to comment further on ShinyHunters’ claims or the purported Okta SSO breach.

Currently, Aura is conducting a thorough internal investigation with the help of external cybersecurity professionals and have confirmed to BleepingComputer that they have informed law enforcement.

Aura has stated that personalized notifications will be sent to those impacted shortly.