ADT Data Breach Lawsuit Claims Cyberattack Exposed Over 10M Records Containing Private Info

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action lawsuit alleges that ADT failed to implement adequate cybersecurity safeguards to protect sensitive customer information from an April 2026 data breach.

Get class action lawsuit and class action settlement news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter.

The 35-page lawsuit contends that ADT was targeted in a cyberattack on or around April 20, 2026, during which network servers were accessed without authorization. Per the suit, the data breach exposed private information belonging to customers and prospective customers of the company, including names, phone numbers, addresses, dates of birth, partial Social Security numbers and tax IDs.

According to the complaint, ShinyHunters, a cybercriminal group, claimed responsibility for the data breach and posted online that it had accessed over 10 million records containing personally identifiable information and internal corporate data.

The lawsuit argues that ADT, as a major provider of residential and commercial security services, knew or should have known that it was a unique target for cybercriminals due to the volume and sensitivity of information it collects from customers and others associated with the company.

As such, the suit alleges ADT had an obligation to implement robust cybersecurity measures to protect that data, as consumers expected when they paid for its services and handed their data over to the company.

“Despite these duties, ADT failed to implement reasonable data security measures to protect Plaintiff’s and Class Members’ Private Information and ultimately allowed threat actors to breach its computer systems and exfiltrate Plaintiff’s and Class Members’ Private Information stored therein,” the complaint asserts.

The suit claims that the breach was a “direct result” of ADT’s alleged cybersecurity failures, including its failure to follow publicly available guidelines from the Federal Trade Commission on how companies can best protect sensitive data.

As a result of the breach, the lawsuit alleges, victims may face ongoing risk of fraud and identity theft “for years to come.” The complaint stresses that the exposure of Social Security information could enable cybercriminals to fraudulently open financial accounts, apply for credit, obtain government benefits or commit medical identity theft.

The suit argues that even a limited amount of personal information can be valuable to cybercriminals, who may combine stolen data with other available information to conduct phishing attacks or list it for sale on the dark web.

Additionally, the suit argues that ADT’s response to the breach has been “wholly inadequate” in that the company has failed to provide timely, specific notice to affected individuals and deliver on its publicly stated promise to offer “complimentary identity protection services as appropriate.”

According to the complaint, ADT’s only public acknowledgment of the breach came through a statement on its website issued four days after the breach occurred. However, the lawsuit alleges that consumers still “remain in the dark” regarding what specific pieces of their information were stolen, how the breach happened and what cybersecurity measures ADT has taken in response.

The ADT data breach class action lawsuit looks to represent all individuals in the United States whose private information was compromised in the data breach.

Looking for current class action lawsuits to join? Check out ClassAction.org’s class action lawsuit list.