Brinks Home Confirms Breach as ShinyHunters Threatens to Leak 4.9 Million Salesforce Records
The residential security company says its alarm systems were not affected, but the extortion group claims to hold customer contacts, employee data and millions of support chat logs.
Key points
- Brinks Home identified the intrusion on July 20 and says its alarm monitoring service was not affected.
- ShinyHunters claims it broke in on July 13 through a vishing call targeting a Microsoft Entra account.
- The group says it took more than 4.9 million records: 1.1 million rows of customer contacts and 3.8 million support chat logs.
- Brinks Home confirms the attacker has threatened to publish the data and warns customers to expect scam messages impersonating the company.
- The company serves more than 1 million customers across the United States and Canada, including Puerto Rico.
Brinks Home, the residential alarm and smart-home provider, has confirmed intruders broke into some of its systems and are now threatening to publish data they claim to have stolen.
The company detected the attack on July 20 and started incident response the same day. CEO William Niles said Brinks Home is working with outside forensics specialists. Alarm monitoring, the service that watches sensors and cameras in customers' homes, wasn't affected. The breach sat on the corporate side.
Who claims responsibility, and how did they get in?
ShinyHunters has claimed the attack. The group told BleepingComputer it broke into Brinks Home on July 13 using a vishing call, a phone call in which someone impersonating IT support talks an employee into completing a security prompt. The target was Microsoft Entra, Microsoft's cloud identity service that controls sign-in access across company systems. Once the employee followed the caller's instructions, the attacker had a working account and pivoted into Salesforce.
That sequence will be familiar to anyone watching this group. Our 14 July report on ShinyHunters and Salesforce found they'd spent a year draining Salesforce tenants by abusing trusted app connections rather than any platform flaw, and two weeks later we reported they'd turned the same vishing tactic on hospital help desks. Brinks Home fits that pattern exactly.
What data is at risk?
ShinyHunters says it took a large volume of personal information from Brinks Home's Salesforce environment and support tools. The company hasn't confirmed the specific numbers, and no one outside the attackers has reviewed the files.
| Data set claimed | Volume | Source system |
|---|---|---|
| Customer contact records | 1.1 million rows | Salesforce "Contacts" object |
| Employee personal details | 4,000+ rows | Salesforce |
| Customer support chat logs | 3.8 million | Brinks Care (Cresta) |
Employee records reportedly include full names, work email addresses, job titles and phone numbers. Brinks Home has told customers it has "not yet confirmed exactly what information was involved or whose" and will notify affected people directly if their data was taken.
Should Brinks Home customers be worried?
No home alarms or cameras were touched, so the physical security of a customer's house isn't in question. The risk is personal data. Brinks Home is warning customers to expect fraudulent messages impersonating the company or others involved in the response: don't reply, don't click any links, delete the message. If a call or email pressures you to hand over a code, hang up and contact Brinks Home on the number printed on your bill.
One consequence worth flagging: stolen contact records from a home-security company are particularly useful for follow-on fraud. Scammers who know your name, address and that you have a monitored alarm have a ready-made pretext for the next call.
The wider picture
ShinyHunters has been running this play throughout 2024 and 2025, tricking a single employee over the phone into approving access, then draining Salesforce customer objects at speed. Brinks Home generates roughly $830 million in annual revenue and employs up to 1,500 people. Its investigation is continuing; notifications will follow once the scope is clear.
