Aura, an identity protection platform, confirmed a data breach affecting approximately 900,000 records from a legacy marketing database inherited through a 2021 acquisition, with roughly 35,000 current and former customers directly impacted. The initial access came through a vishing attack against an Aura employee, which provided the attacker, claimed by ShinyHunters, with valid credentials to the acquired database. The core business risk is twofold: reputational damage from a breach at an identity protection company, and demonstrated systemic exposure from post-acquisition data governance gaps that left inherited systems with insufficient access controls.