Cyber Incident Victim: ADT Inc.
Date:
Jan 2024
Location:
United States of America
Summary
An attacker breached ADT's systems using compromised credentials obtained through a third-party business partner, leading to the exfiltration of encrypted internal data associated with employee user accounts. The company disrupted unauthorized access, notified the affected third party, implemented countermeasures, and engaged external cybersecurity experts and federal law enforcement to investigate and respond. While containment efforts caused some information system disruptions, the investigation indicates no compromise of customer personal information or security systems. This incident follows a separate recent cybersecurity event involving unauthorized access to customer order databases.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
ADT Inc. discovered unauthorized network activity stemming from compromised credentials obtained through a third-party business partner, as disclosed in a January 1, 2024, securities filing. The company promptly contained the breach by disrupting the attacker’s access, notifying the affected third party of their compromised systems, and implementing countermeasures to protect IT assets and operations. ADT confirmed the attacker exfiltrated encrypted internal data associated with employee user accounts during the intrusion but stated no evidence indicated customer personal information or security systems were compromised. The containment efforts caused disruptions to some of ADT’s information systems, though the company did not specify the nature or duration of these operational impacts. This incident marked the second cybersecurity breach disclosed by ADT within two months, following an August 7, 2023, filing that revealed unauthorized access to databases containing customer order information. ADT engaged external cybersecurity experts to assist with the investigation and response, coordinated with federal law enforcement, and collaborated with the third-party partner to address the breach. The company declined to confirm whether ransomware was involved or detail the specific types of system disruptions experienced during recovery.
The breach highlighted vulnerabilities linked to third-party credential compromises, a persistent threat vector accounting for nearly one-third of global cyberattacks in 2023 according to IBM X-Force data. ADT’s investigation remained ongoing as of the filing date, with the company emphasizing the preliminary nature of its findings and the possibility of new information altering its assessment. The 150-year-old firm, serving over 6 million U.S. customers, acknowledged forward-looking risks in its SEC filing, including potential reputational damage, operational delays, legal consequences, and challenges in coordinating remediation efforts with its third-party partner. While ADT expressed confidence in its containment measures, it cautioned that future developments could reveal broader impacts, including undetected exfiltration of additional data or systemic weaknesses in its security posture. The company’s public statements provided no timeline for the attack’s discovery or the duration of unauthorized access prior to containment. System disruptions resulting from ADT’s defensive actions underscored the operational trade-offs inherent in incident response, though specific affected business functions were not disclosed. ADT maintained its focus on securing employee account data and restoring normal operations while continuing to evaluate the incident’s scope through its investigation.