Months After the ADT Breach: Scam Warnings and ADT's New Unusual Activity Alerts
The ADT breach of April 2026 is back in the conversation, but some of what looks new is not. Here is the honest picture: what was stolen, what the recirculated "October warning" stories really are, what ADT genuinely announced, and the protective steps traced to the FTC and ADT.
The "new" October warnings are recycled May coverage
A CyberGuy consumer piece titled "ADT data breach exposes customer information" was originally published on May 1, 2026, warning: "You may begin to see more targeted scam calls or emails. Messages might include your name or reference your address to appear legitimate."
The versions dated October 21, 2026 are word-for-word reprints of that same May article on spammy mirror domains (sunshinecoasttourism.com.au and southaustraliatravel.com.au). There is no fresh October report. The advice stays valid, because the stolen data is still out there, but the "breaking October warning" framing is recycled coverage, not new reporting.
What was stolen, and what ADT denies
Have I Been Pwned's independent analysis of the leaked dataset put it at roughly 5.5 million unique email addresses: its own count, not ADT's. ADT has confirmed no number, saying only that limited customer and prospective customer data was accessed. The hacking group's claim of more than 10 million records remains unconfirmed by ADT.
ADT's confirmed scope, from its own security notice: the accessed data was limited to names, phone numbers, emails, and addresses, with dates of birth and the last four digits of Social Security numbers or Tax IDs in a small percentage of cases. What was not taken, per ADT: "Critically, no payment information, including bank accounts or credit cards, was accessed, and customer security systems were not affected or compromised in any way." For the full chronology, see our earlier coverage: what happened in the ADT breach.
The real risk: scams that sound like ADT
Your alarm was not compromised and your cards were not taken. What was taken is arguably more useful to a scammer: your name, phone number, and home address, paired with the knowledge that you are an ADT customer. A caller who knows all of that sounds legitimate in a way a random robocall never does.
Expect the scams to wear an ADT costume: a caller who knows your name, number, and address, claims to represent ADT, and pressures you to click a link or share personal information on the spot. ADT's own notice warns customers to "remain alert for phishing emails, phone calls, or text messages from individuals claiming to represent ADT and to avoid clicking links or sharing personal information unless the source has been verified." An unconfirmed October 6 analysis by sh3llc0d3 argues the address leak also enables impersonation, such as a caller posing as an ADT field technician, and SIM-swapping using leaked numbers: a scenario worth keeping in mind, not a verified fact.
What is actually new: Unusual Activity Alerts
The genuinely new development is a feature, not a breach update. On September 23, 2026, ADT announced Unusual Activity Alerts for ADT+: a feature that "learns patterns across connected devices and sensors, detects meaningful changes in those patterns, and alerts customers when something appears out of the ordinary."
From ADT's own announcement: no-cost for ADT+ customers with a V5 or newer Base paired with door/window sensors, a smart lock, a garage door controller, or Z-Wave smart lights (professionally installed and ADT Blu DIY systems alike). On privacy: "Designed with privacy in mind, no video, audio or camera clips are used to learn patterns. Alerts are based solely on data from the connected devices and sensors." It needs at least 14 days of activity history, ignores history older than 60 days, sends a phone alert showing the prompting event, learns from thumbs up or down feedback, and can be switched off in the ADT+ app's Notifications menu. ADT cautions: "Unusual Activity Alerts are not a replacement or substitute for life safety monitoring features."
ADT has made no connection between this feature and the April breach, and its announcement mentions no breach at all. Presenting it as ADT's response to the breach would be an inference, not a fact.
Protective steps, traced to the sources
1. Let ADT's posture set your baseline. ADT says no action is needed at this time, but asks customers to stay alert for phishing emails, calls, or texts from people claiming to represent ADT, and to verify the source before clicking links or sharing personal information.
2. Hang up and call back. Reported consumer-press advice worth repeating: pause before responding to anyone claiming to be from ADT, hang up, and contact the company directly on a verified number. Treat unexpected password-reset emails or codes as a warning sign.
3. Put a credit freeze in place. The FTC recommends placing a credit freeze on your reports: free to place and lift, through each of the three bureaus (Experian, TransUnion, Equifax). A freeze blocks new accounts from being opened in your name.
4. Consider a fraud alert. Also per the FTC, an initial fraud alert is free and lasts one year. Contact one bureau, and it must notify the other two.
5. Never share payment details with an inbound caller. No payment information was taken in this breach, so any caller asking for your card number "to verify your account" is running a scam. ADT's notice says to avoid sharing personal information unless the source has been verified.
6. Know your recovery path. The FTC points identity-theft victims to IdentityTheft.gov for a free personal recovery plan. If you were among the small percentage with partial Social Security or Tax ID exposure, ADT offered complimentary identity monitoring through Cyberscout (a TransUnion company), details mailed the week of June 26.
Frequently Asked Questions
Was there a new scam-warning report on October 21, 2026?
No. The October 21 dated copies are reprints of a CyberGuy piece originally published May 1, 2026, appearing on mirror domains. The warning inside (expect targeted scam calls and emails using your name and address) stays valid, but the "fresh October report" framing is recycled coverage, not new reporting. The original is also heavily affiliate driven, so treat its product pitches as advertising, not security facts.
Was my credit card or bank account information taken?
No. ADT stated explicitly that no payment information, including bank accounts or credit cards, was accessed, and that customer security systems were not affected or compromised.
What is ADT's Unusual Activity Alerts feature?
Announced September 23, 2026, it is an ADT+ feature that learns your household's patterns from connected devices (door and window sensors, smart lock, garage controller, or Z-Wave lights) and alerts your phone when something appears out of the ordinary. No video, audio, or camera clips are used; it needs at least 14 days of history and can be switched off in the ADT+ app. ADT cautions it is not a replacement for life safety monitoring, and has not linked the feature to the April breach.
Does ADT say I need to do anything?
ADT says no action is needed at this time, but asks customers to stay alert for phishing from people claiming to represent ADT and to verify any source before clicking links or sharing personal information. If you want maximum protection anyway, the FTC's free credit freeze costs nothing.
