Aura is a digital security company providing identity theft protection and monitoring services to consumers. In 2026, the company was the target of a cyberattack that resulted in a data breach affecting approximately 900,000 consumer records.
Background Aura is a consumer-facing cybersecurity company based in Burlington, Massachusetts, that provides identity theft protection, fraud monitoring, credit monitoring, anti-virus and device security services.
Founder and SEC charges The company was founded by CEO Hari Ravichandran in 2017 under the name "iSubscribed." Ravichandran had been charged by the SEC with over-stating the number of subscribers at his prior company, Endurance International Group, while selling his own shares into the market. Endurance paid $8 million to settle the complaint, while Ravichandran additionally agreed to personally pay $1.38 million to the SEC. Neither admitted wrongdoing.
Acquisitions and CFPB charges In 2019, iSubscribed acquired the company "Intersections Inc", which had previously been sued by the Consumer Financial Protection Bureau. The CFPB alleged that Intersections charged consumers for credit reports that it knew it could not deliver. Intersections settled by signing a consent order in which it paid a penalty of approximately $1.2 million, plus restitution to consumers. The Intersections product is now known as Aura's Identity Guard product line. The company rebranded as "Aura" after the merger.
In 2021, Aura acquired Circle Media Labs, Inc. ("Circle"), a company whose sales and marketing database was central to the 2026 data breach. Following the acquisition, Aura retained some of Circle's marketing tools and associated contact lists.
2026 data breach Hacker group ShinyHunters gained access to an Aura marketing list through a vishing attack in March 2026; approximately 900,000 records were stolen. The stolen records primarily consisted of names and email addresses from a marketing tool used by a company Aura acquired in 2021, but also included approximately 35,000 records with more detailed information, including home addresses and phone numbers. The company said no financial information, Social Security numbers, or passwords were taken.
References