The residential security provider detected the intrusion on July 20 and launched its incident response process to contain the attack. Brinks Home said its alarm monitoring services and home security systems remained operational throughout the incident.
William Niles, CEO of Brinks Home, said the company is working with “leading forensics experts to address this issue.”
The ShinyHunters extortion group has claimed responsibility for the breach and alleges that it obtained millions of records from cloud-based business applications used by Brinks Home. The group has previously been associated with attacks targeting Salesforce environments and other software-as-a-service platforms.
Brinks Home has not confirmed the amount or type of data involved. The company said the attacker has threatened to release information it claims to have taken, but investigators are still determining which records may have been accessed and who could be affected.
Customers whose personal information is confirmed to have been compromised will receive direct notifications from the company, along with guidance on any protective measures they should take.
The incident illustrates how cybercriminals are increasingly targeting cloud applications that store customer records, employee information and support communications rather than attempting to penetrate traditional corporate networks.
“ShinyHunters’ targeting of Brinks Home’s Salesforce instance is consistent with a broader shift in extortion tradecraft,” said Josh Picolet, vice president of detection and analysis at Team Cymru. “These groups are no longer relying primarily on network intrusion, they are going directly after the SaaS platforms where customer data actually lives, environments that sit outside the visibility most security teams have built their detection programs around.”
Picolet said organizations should extend security monitoring beyond internal networks and treat cloud services and third-party platforms as part of their core attack surface.
Brinks Home is also warning customers to be alert for phishing emails, fraudulent text messages and other communications that may impersonate the company or parties involved in the investigation. Customers should avoid clicking unexpected links or responding to messages requesting credentials, payments or personal information.
The attack reinforces a growing cybersecurity challenge for enterprises: protecting sensitive data across Salesforce, Microsoft Entra and other cloud platforms that have become central to daily operations.
