Brinks Home, one of the largest residential security and alarm monitoring providers in North America, has confirmed that intruders accessed its back-office systems after the extortion group ShinyHunters posted the company to its leak site. The gang claims to be sitting on close to five million records lifted from Brinks Home’s Salesforce environment and related support tools.

A Week of Silent Access

According to the company’s own account, the intrusion was first noticed on July 20, 2026, meaning attackers likely had roughly a week inside Brinks Home’s systems before the breach was contained. That window is fairly typical for this style of attack: enough time to map out data stores and pull large volumes of records without immediately tripping alarms.

ShinyHunters gave Brinks Home a deadline of July 30 to pay a ransom before the group would publish the stolen files. When that deadline passed, the group listed the company under the name “BH Security, LLC” on its extortion site, a pressure tactic the crew has used repeatedly against other victims this year.

What Was Reportedly Taken

Court of public opinion aside, the numbers ShinyHunters is advertising break down into a few buckets:

• Over 1.1 million rows pulled from the Salesforce “Contacts” object, likely customer names and account details.
• Roughly 4,000 rows of employee information, including names, email addresses, job titles, and phone numbers.
• Close to 3.8 million customer support chat transcripts taken from the Brinks Care platform, which runs on the Cresta conversational AI tool.

Security researchers reviewing the claim note that the widely quoted “4.9 million records” figure is really a sum of distinct data rows and chat logs, not a count of unique individuals affected — a distinction that matters for anyone trying to gauge the real scope of exposure.

Core Security Systems Reportedly Unaffected

Brinks Home has been careful to draw a line between the compromised back-office tools and the physical security products it sells. The company says alarm monitoring, panel connectivity, and day-to-day system functionality kept running normally throughout the incident, since the affected systems sat in customer support and CRM infrastructure rather than the monitoring network itself.

That distinction won’t be much comfort to customers whose support conversations may now be in criminal hands. Chat transcripts from a home security provider routinely contain service addresses, details about installed equipment, entry codes discussed for troubleshooting, and account history — exactly the kind of context that makes a follow-up phishing call or text sound convincing.

Part of a Bigger ShinyHunters Pattern

This isn’t an isolated event. ShinyHunters has run a string of similar campaigns through 2026, leaning on social-engineering calls, or vishing, aimed at tricking employees or help-desk staff into granting access through identity providers like Microsoft Entra and Okta. Prior targets tied to the same playbook reportedly include Cushman & Wakefield, Kodak, and Sysco, suggesting the group has refined a repeatable method for getting into Salesforce-connected environments at large enterprises.

For defenders, the recurring lesson is that Salesforce and other SaaS platforms are increasingly treated by attackers as a single point of failure across many unrelated companies, since the access techniques transfer easily from one victim to the next.

What Happens Next

Brinks Home says it has not yet finished determining exactly whose data was affected or the full extent of what was accessed, and has promised to notify impacted individuals if personal information is confirmed to be compromised, in line with applicable breach notification laws.

In the meantime, the company is urging customers and employees to treat unexpected emails, texts, or phone calls referencing the breach with suspicion. Brinks Home has stated plainly that it will never ask for sensitive account information through unsolicited outreach, and it is advising anyone contacted about the incident to hang up or ignore the message and instead reach the company directly through verified, official contact channels rather than any number or link included in a suspicious message.

Given ShinyHunters’ history, security teams elsewhere would do well to treat this less as a one-off headline and more as a reminder to audit who and what can reach their own Salesforce instances, and how easily a convincing phone call could talk a help desk into handing over the keys.