ADT Inc.

The break-in ran through ADT's Salesforce instance, reached not by an exploit but by phoning an employee out of their Okta login: identity treated as the perimeter folds the moment someone answers politely. What left was names, phone numbers, and addresses, with dates of birth and partial Social Security numbers for some; ShinyHunters claims over 10 million records against the roughly 5.5 million accounts others counted. A home security firm can arm every door it sells and still leave its customer list open to a phone call.