Breach taxonomy
Summary
ADT experienced a cybersecurity incident in which unauthorized actors illegally accessed databases containing customer order information. The company shut down the unauthorized access and engaged third-party cybersecurity experts. Attackers obtained limited customer information including email addresses, phone numbers, and postal addresses from a small percentage of ADT's subscriber base. Customer home security systems were not compromised and no credit card or banking information was obtained. Filed under Item 8.01; company determined the incident was not material.
Tagging rationale
ThreatUnknown
Filing refers to 'unauthorized actors' without attributing to a specific actor category → UNKNOWN.
MethodsData Exfil
Unauthorized actors gained access to customer databases and actively exfiltrated customer contact information → DATA-EXFIL.
AssetsPersonal Data
Attackers accessed databases containing customer order information and obtained email addresses, phone numbers, and postal addresses → PERSONAL-DATA.
EffectsInfo Privacy Loss
Customer personal contact information (email, phone, address) was exfiltrated; no operational disruption or financial fraud → INFO-PRIVACY-LOSS.
Impact
Limited customer PII (email, phone, address) from a small percentage of ADT's subscriber base; no financial data, no system compromise, non-material per company → score 2.
InsuranceNot disclosed
Filing makes no mention of insurance → null.
Read the original SEC filing excerpt
Item 8.01 Other Information. ADT Inc. (ADT or the Company) recently experienced a cybersecurity incident during which unauthorized actors illegally accessed certain databases containing ADT customer order information. After becoming aware of the incident, the Company promptly took steps to shut down the unauthorized access and launched an investigation, partnering with leading third-party cybersecurity industry experts. The attackers nonetheless obtained some limited customer information, including email addresses, phone numbers and postal addresses. Based on its investigation to date, the Company has no reason to believe that customers' home security systems were compromised during this incident. Additionally, the Company has no reason to believe the attackers obtained other personally sensitive information such as credit card data or banking information. The Company is continuing its investigation into this cybersecurity incident and has notified the customers it believes to have been affected, who comprise a small percentage of the Company's overall subscriber base.