August 8, 2026: Have I Been Pwned loaded the published Brinks Home corpus — 732,162 unique email addresses for leads, customers and staff, with names, phones, physical addresses, dates of birth, purchase history and partial credit card data. The dump follows Brinks’ confirmation that attackers reached a portion of its IT systems and ShinyHunters’ pay-or-leak campaign against the smart-home security brand.
If you ever requested a Brinks quote, bought a system, or worked for the company, check HIBP with the email you used. This is no longer only an extortion listing — it is a verified load of published personal data.
What happened
Brinks Home (BH Security) posted a cybersecurity update acknowledging unauthorized access to a portion of its IT systems. The company said it activated incident response, contained the situation, and that alarm monitoring and system functionality continued without interruption. It also said the responsible party threatened to release information it claimed to have taken, and that Brinks would notify impacted individuals as required once it determined what was involved.
ShinyHunters had already listed Brinks and threatened publication. Trade press in late July covered the company’s confirmation and the group’s claims of Salesforce and Cresta-related material. On August 8, HIBP indexed the published set at 732,162 unique emails and classified the fields listed below.
Earlier actor marketing floated much larger “~4.9 million Salesforce records” and ~41GB figures. Those remain actor claims. BreachHistory now uses the HIBP unique-email count as the attested scale for catalog recordsAffected.
Timeline
- ~July 13, 2026 — HIBP breach date; ShinyHunters claimed Entra vishing around this window.
- ~July 20 — Brinks identifies unauthorized access (per earlier coverage).
- Late July — Company public notice; ShinyHunters extortion and publication pressure.
- August 8 — HIBP loads 732,162 unique emails with personal and partial payment fields.
That stretch from mid-July access to early August publication is short by modern breach standards. Individuals often hear about a dump days after criminals finish marketing it — which is exactly when phishing that name-drops the brand spikes.
What was exposed
HIBP’s inventory for the Brinks Home load is concrete:
- Email addresses (732,162 unique)
- Names
- Phone numbers
- Physical addresses
- Dates of birth
- Purchases
- Partial credit card data (last four digits, card type, expiry)
Partial card data is not a full PAN dump. Paired with name, address and purchase history, though, it is enough to make bank-verification and “confirm your Brinks billing” scams painfully believable. Full CVVs were not listed in HIBP’s classes.
Brinks’ own page still frames individual notification as forthcoming once the company finishes determining who is affected. Treat the HIBP field list as the public floor until mailed letters arrive with state-specific detail.
What was not hit — and why that matters
Brinks emphasised that alarm monitoring kept running. This is a data-theft and extortion story, not a “your sirens went dark” story. For a physical-security brand, that distinction is brand-critical. It is also cold comfort if your home address and phone are in a criminal corpus.
Home addresses plus a security-vendor relationship are a physical-security concern. Burglars and social engineers both like knowing who pays for monitored alarms. The monitoring network staying up does not erase that risk.
What this is not: evidence that every Brinks household lost full payment-card numbers, passwords, or camera footage. HIBP did not list passwords or video as classes. Do not invent those fields — and do not ignore the ones that are listed.
How the attack was framed
Public reporting on the campaign described a familiar 2026 pattern: voice phishing against identity systems, then movement into CRM and support tooling where customer rows live. Brinks has not published a full technical root-cause advisory for the public. What is confirmed is unauthorized access, extortion threats, publication, and now an HIBP-attested personal-data load.
If you defend a company with Salesforce, Cresta-like support stacks, or Entra-joined sales tools, this is another data point that “monitoring uptime” and “CRM confidentiality” are different control problems. The NOC can look healthy while the quote pipeline is already on a leak site.
Boards that fund the alarm network and starve identity and SaaS access reviews get exactly this outcome: customers hear “your alarms still work” and still need to freeze credit and watch phishing. Both statements can be true on the same day.
Who is at risk
Customers and leads whose emails appear in quote, install or support systems — including people who only requested a sales call. HIBP’s inclusion of leads matters. People who never completed an install still handed over contact data to a sales pipeline. They will not think of themselves as “Brinks customers” and may ignore headlines. Check HIBP anyway if you requested a quote in 2024–2026.
Staff — HIBP’s description explicitly includes Brinks staff records in the published set. Employees should treat IT callback and MFA fatigue prompts as hostile until verified out of band.
Household members at the same address who may get phishing that name-drops Brinks even if they never opened an account.
Anyone who reused passwords between a Brinks portal and other sites should rotate those credentials even though HIBP did not list passwords as a class. Habit reuse is not the same as a password dump, but the email+name pairing still fuels stuffing elsewhere.
Dealers and MSPs who sold Brinks-branded gear will field customer calls before those customers read Brinks’ page. Prepare a FAQ that separates “monitoring is up” from “your CRM row may be in a dump,” and do not collect passwords “to check the account” over the phone.
Why home-security PII is different
Physical security brands sit on a rare mix: precise home addresses, phone numbers, and proof that the household cares about intrusion detection. That mix is useful for burglary casing and for vishing that opens with “I’m with your alarm company.”
A stolen address from a retailer is annoying. A stolen address from an alarm vendor tells an attacker which house paid for sensors and which phone to call when the “system” supposedly needs a code reset. The Brinks Home data breach lands in that category — not because monitoring failed, but because the customer relationship data is itself a physical-security input.
Competitors in DIY and professionally monitored security should expect copycat phishing that spoofs Brinks even against non-customers. Brand confusion is free for attackers once one household name is in the news.
Partial cards and bank social engineering
Last-four digits, card type and expiry are exactly what many automated bank phone trees and chat bots ask for as “verification.” Attackers who also know your name, address and that you bought a security system can sound like a legitimate fraud department. The defence is the same as always: you call the number on the back of the card; they do not call you into a session you did not start.
If you only ever paid Brinks by ACH or invoice, you may still be in the email and address dump. Card fields are not required for every phishing path. Warranty, shipping and “camera offline” themes work without a PAN.
Watch statements for small test charges and unfamiliar merchants. Partial card data plus identity fields also help attackers open new cards in your name if they already hold other identifiers from older breaches.
Actor counts versus HIBP
When a leak site claims millions of “records,” those rows can be chats, tasks, duplicates and empty fields. HIBP’s unique-email metric answers a different question: how many distinct inboxes appear in the published corpus. Both numbers can be “true” in their own frames.
For BreachHistory’s recordsAffected field on verified loads, HIBP wins. The earlier ~4.9 million Salesforce-row marketing number is still visible in older coverage; it is no longer what we index as the attested headcount. Readers comparing July headlines to August HIBP numbers are not seeing a contradiction so much as two different counters.
If Brinks later publishes a higher or lower individual-notification count in AG filings, that can supersede or sit beside HIBP depending on what the company is counting (households vs emails vs legal notice recipients). Until then, 732,162 unique emails is the checkable public figure.
Industry and campaign context
ShinyHunters’ 2026 playbook has repeatedly turned identity compromise into publishable CRM extracts. Exact Sciences / Abbott Cancer Diagnostics is another August HIBP example in the healthcare lane. Brinks adds a consumer home-security brand to that list.
The operational lesson for boards is not “buy better cameras.” It is “assume sales and support clouds are crown jewels equal to the monitoring network.” Salesforce rows, support transcripts and lead lists travel farther than panel firmware once they leave the building.
Voice phishing against Entra and similar identity platforms remains a durable initial access story in 2026 trade press. MFA that only challenges the employee who already trusts the caller is not MFA that survives a convincing helpdesk script. Number matching, phishing-resistant authenticators and out-of-band verification for password resets are the boring controls that keep CRM dumps off leak sites.
Related catalog reading for campaign shape: other ShinyHunters rows such as JCPenney HR extortion and large confirmed CRM-scale cases elsewhere in retail and health. The brands differ; the pattern of identity → SaaS export → pay-or-leak does not.
What the company said
Brinks’ public cybersecurity update and FAQ emphasise containment, continued monitoring, and forthcoming individual notice consistent with law. The company warns customers about scams that impersonate Brinks and says it will not ask for sensitive information through unsolicited messages.
That last line is the one households should tape to the fridge. Real account problems wait for authenticated sessions you start yourself. Fake “monitoring cancelled in one hour” emails do not.
What Brinks still owes the public is a finished field-by-field notice with state-level counts for AG filings and class actions. Regulators and insurers will ask how quickly the company moves from “we are investigating who is affected” to mailed notices. That clock is now public because HIBP made the corpus searchable.
Practical script for households
If someone calls claiming to be Brinks technical support, hang up and use the phone number on your contract or the official site — not caller ID. If an email says your monitoring will be cancelled unless you click, it is fake.
Tell teenagers and caregivers in the house the same rule. Alarm brands are impersonated precisely because families panic about “the system going down.” Attackers know that panic is faster than reading an FAQ.
If you get a letter that looks like Brinks but asks you to visit a non-brinkshome.com domain to “confirm your free credit monitoring,” compare the URL character by character. Typosquats love security-brand news cycles.
What you should do
- Check Have I Been Pwned with every email you used for Brinks quotes, accounts or employment.
- Watch for alarm-company phishing — fake renewal fees, “camera offline” links, or callers asking for panel codes.
- Call your bank if you see unfamiliar card activity; partial card data plus identity fields enable social-engineering against issuers.
- Consider a credit freeze if you ever provided SSN or government ID to Brinks or a dealer — even if SSN is not in the HIBP class list, dealer paperwork sometimes travels separately.
- Employees: treat IT callback and MFA fatigue prompts as hostile until verified out of band.
- Keep Brinks’ notice and any future letter for disputes with banks and credit bureaus.
- Rotate reused passwords on any account that shared a password with a Brinks portal, then turn on MFA where it was off.
- Dealers: publish a short customer note now so your phones are not the only communication path.
Waiting for a perfect letter is how people miss the phishing wave that starts the week a dump hits forums. HIBP plus the company acknowledgment are enough for individuals to act today.
Was I affected?
Search HIBP first. If your email is in the load, assume the associated name, phone and address fields may be in the same dump even if you never see those fields in the HIBP UI. Treat purchase history and partial card data as potentially exposed for customer rows.
If HIBP is clean for every email you remember, you may still receive a Brinks letter later if the company counts affected people differently (for example, by household or by legal notice rules). Keep watching mail and official Brinks channels — not random Facebook ads about “Brinks breach payouts.”
Credit freeze, monitoring and next steps
A credit freeze at the major bureaus is still the highest-leverage move when home address, DOB and name travel together. Freezes do not stop every scam, but they raise the cost of new-account fraud. Place freezes at Equifax, Experian and TransUnion; lift them temporarily only when you initiate credit.
If Brinks later offers complimentary monitoring, enroll if the offer is real and the enrollment domain matches the letter. Monitoring is not a substitute for a freeze; it is an alert layer after someone already tried something.
File taxes carefully if DOB and SSN appear in any later notice. Early tax filing and IRS identity-protection PINs reduce the odds of a fraudulent return in your name after a broad identity dump — even when the first public inventory is “only” email and address heavy.
Keeping physical security separate from identity security
It is possible — and Brinks says it happened here — for monitoring infrastructure to stay healthy while identity and CRM systems fail. Customers should hear both messages without collapsing them into one. Alarms working is good. Your quote email being searchable on HIBP is a different problem with different homework.
Until individual letters arrive, treat any Brinks-themed urgency as hostile, verify out of band, and use HIBP as your personal early-warning system for this incident.
Canonical record and sources
Brinks Home 2026 on BreachHistory — company-confirmed incident; HIBP 732,162 unique emails with partial card data.
Sources: Brinks cybersecurity update, Brinks FAQs, Have I Been Pwned, BleepingComputer, SecurityWeek.
Published 2026-08-08. Catalog count updated from earlier unverified ~4.9M actor marketing to HIBP’s unique-email load.