Your Alarm Company Got Hacked: What ADT Customers Should Do Now
There is a special kind of irony when the company guarding your front door gets broken into itself. In April 2026, home security giant ADT disclosed that hackers got into some of its cloud-based systems and walked away with customer information. Six months later, the story is back in the headlines, and authorities are now closing in on the hacking group that cyber press has blamed for the attack. If you are an ADT customer, this is the right moment to make sure you are not the next target.
What actually happened
On April 20, 2026, ADT said it detected unauthorized access to certain of its cloud-based environments. The company cut off the intruders, activated its incident response plan, brought in outside cybersecurity experts, and notified law enforcement. It disclosed the incident in a regulatory filing with the U.S. Securities and Exchange Commission on April 24.
In its own statement that same day, ADT said the investigation confirmed the stolen information was limited to customer and prospective customer names, phone numbers, and addresses. In a small percentage of cases, dates of birth and the last four digits of Social Security numbers or Tax IDs were included as well.
Two things the company was explicit about: no payment information, including bank accounts or credit cards, was accessed, and customer home security systems were not affected or compromised. ADT said it directly notified everyone who was impacted and would offer identity protection services where appropriate.
ADT is one of the largest home security companies in the United States, reporting approximately 6.1 million security monitoring subscribers at the end of 2025. So even a "small percentage" of that customer base is a lot of real names, real phone numbers, and real home addresses in criminal hands.
Why this is in the news again now
In late September and early October 2026, law enforcement moved against ShinyHunters, the hacking group that cyber press blamed for the ADT attack. Dutch police arrested a suspect in mid-September, and Reuters reported in early October that another alleged group administrator was detained in Jordan and is cooperating with the FBI.
Two important caveats. ADT itself has never confirmed who attacked it, and it has never confirmed the group's claim of stealing more than 10 million records. Those are unconfirmed claims from the hacking group and the cyber press, not ADT's figures. Treat them as claims, not facts.
The renewed coverage has a practical upside, though: it is a reminder that the stolen data is still out there, and the most likely way it gets used against you is the oldest trick in the book.
The real risk is not your alarm. It is your phone.
Your ADT system was not compromised, and your credit cards were not taken. What was taken is something arguably more useful to a scammer: your name, your phone number, and your home address, together with the knowledge that you are an ADT customer.
That combination makes for extremely convincing phishing. A call from someone who knows your full name, your address, and that you have an ADT system sounds legitimate in a way a random spam call never does. Expect the scams to sound like ADT: a "technician" who needs to "verify" your account, an urgent alert about your system, a "free upgrade" that requires a payment or a remote-access session. Expect them by phone, text, and email.
What to do now
1. Treat every unexpected ADT contact as guilty until proven innocent. If someone calls, texts, or emails claiming to be ADT, do not engage on that channel. Hang up, then reach ADT yourself through the app, the number on your bill, or the contact page on ADT's official website.
2. Never hand over payment details or remote access to an inbound caller. ADT was explicit that no payment data was taken in this breach, which means any caller asking for your card number "to verify your account" is running a scam. The same goes for anyone who wants you to install remote-access software.
3. Watch for phishing that uses your real details. The giveaway used to be a generic "Dear Customer." That is gone now. A scam message can use your real name and address. The tells that remain: urgency, threats of service cutoffs, links you did not ask for, and requests for information the company should already have.
4. Lock down the accounts that matter. Use a unique password for your email and banking, and turn on two-factor authentication everywhere it is offered. If you reused your ADT account password anywhere else, change it there too.
5. Consider your credit exposure. ADT says only names, phone numbers, and addresses were taken for most people, with partial Social Security data in a small slice of cases. That is not enough for full identity theft on its own, but it is enough for scammers to build a convincing profile. If you want maximum protection, a credit freeze with the major bureaus costs nothing and blocks new accounts from being opened in your name.
6. Keep an eye on your statements. Small unfamiliar charges and unexpected password-reset emails are early warning signs, so monitor your accounts for unusual activity and do not dismiss the small stuff.
Frequently asked questions
Was my ADT alarm system hacked? No. ADT said customer home security systems were not affected or compromised in any way. Your alarm still works.
What data was actually stolen? According to ADT, names, phone numbers, and addresses, plus dates of birth and the last four digits of Social Security numbers or Tax IDs in a small percentage of cases.
Was my credit card or bank account information taken? No. ADT said no payment information, including bank accounts or credit cards, was accessed.
Did the hackers really steal 10 million records? That number came from the hacking group itself and was never confirmed by ADT. Treat it as an unconfirmed claim, not a fact.
Who was behind the attack? ADT has not named an attacker. Cyber press attributed claims to a group called ShinyHunters, but that attribution is unconfirmed by ADT.
What is happening to the hackers now? In late September and early October 2026, authorities detained suspects linked to the ShinyHunters group in the Netherlands and Jordan, with one reportedly cooperating with the FBI. These are reported law-enforcement actions, and the cases are ongoing.
I never got a breach notice from ADT. Am I safe? ADT said it directly notified all impacted individuals. If you did not get a notice, your information was most likely not among the data taken. Either way, the phishing precautions above cost nothing and protect you against every breach, not just this one.
If this story has you thinking harder about home security in general, our guide to the best home security systems for renters compares the main options without the hard sell.
