When the Company Protecting You Gets Breached
In March 2026, Aura — the identity protection service we recommend — disclosed a breach. Here's how to actually think about that, for Aura and for every other security vendor.
There's a specific kind of irony that happens in this industry: a company whose entire business is protecting people from being breached, gets breached. It's happened to Aura. LifeLock has had its own incident. It will happen again, to someone. The honest question isn't whether that's alarming — it is — it's whether it should actually change how you evaluate these tools.
What actually happened
In March 2026, an Aura employee was phished by phone — a vishing attack — giving an attacker roughly an hour of account access. About 900,000 records were taken (a count independently confirmed by Have I Been Pwned), but according to Aura almost all of it came from a legacy marketing list Aura inherited through a 2021 acquisition, not the database behind its actual identity-monitoring product. Aura says no Social Security numbers, passwords, or financial data were involved. Aura cut off access within about an hour, brought in outside cybersecurity and legal experts, and notified law enforcement.
LifeLock's parent company, Gen Digital (which also owns Norton), had a different kind of incident. In December 2022, attackers ran a credential-stuffing attack — using usernames and passwords stolen from other sites — against Norton accounts, and the company said roughly 925,000 accounts were targeted. Gen Digital said its own systems weren't compromised, but about 6,450 customers were notified that someone had used their login. For people who used Norton Password Manager, details stored in the vault may have been exposed, especially if the vault password matched the account password.
Two incidents, two different kinds of problem
Mostly names and email addresses from a legacy marketing list. According to Aura, the actual monitoring product and its data weren't involved. About 900,000 records were accessed, but Aura says full contact details (name, email, home address, phone number) for fewer than 20,000 current and fewer than 15,000 former customers were among them — around 35,000 at most — since most of the list was marketing contacts rather than active users.
Not a breach of Norton's own systems: attackers logged into individual accounts using passwords reused from other sites. About 925,000 accounts were targeted and roughly 6,450 customers were told their accounts had been accessed. The sensitive part is that it reached Norton Password Manager accounts, where stored vault details could have been exposed for users whose vault password matched their account password.
Why a breach doesn't automatically disqualify a vendor
If "has this company ever been breached" were the bar, virtually no security vendor would clear it — including ones with far better reputations than either of these. The more useful questions are what was actually exposed, and how the company responded. A breach that never touched the systems actually protecting you, disclosed quickly and handled with outside help and law enforcement involvement, is a fundamentally different event than one that hit the core product or got buried for months before anyone found out.
This is also, in a strange way, the argument for identity protection rather than against it. The entire premise of monitoring is that exposure is going to happen — to you, to the companies you use, to companies you've never heard of holding your data. The value isn't a guarantee that nothing will ever go wrong. It's shrinking the gap between when something goes wrong and when you find out, from months down to hours, so you can act before real damage is done.
What to actually check when a vendor you use gets breached
- ✓ What data was actually exposed — a marketing list is very different from account credentials or financial data
- ✓ How fast the company detected and contained it — hours is a meaningfully different story than months
- ✓ Whether they disclosed it transparently, or it only came out through outside reporting
- ✓ Whether outside experts and law enforcement were brought in, versus handled quietly in-house
- ✓ Whether this is a pattern — repeated incidents are a different signal than a single, well-handled one
The real lesson: don't rely on any single vendor
Whatever monitoring service you use, it's one layer, not a guarantee. The same logic that applies to the vendor applies to your own setup: unique passwords through a password manager, multi-factor authentication on anything that matters, and a credit freeze if your Social Security number or financial data is ever actually involved in an exposure. A monitoring subscription catches things you'd otherwise miss — it was never meant to be the only thing standing between you and a bad outcome.