The Brinks Home breach this past July was not a hypothetical scenario. It was a masterclass in old-school manipulation. An IT administrator at the security firm received a call from someone who sounded professional, urgent, and perfectly human, requesting authorization for a routine software update. They complied, as it was their job. A few days later, the company realized they had handed the keys to their entire customer database to the ShinyHunters hacking group.
The campaign hits Brinks Home, ADT, and EY in rapid succession, proving these are not isolated incidents but a coordinated effort to exploit corporate IT infrastructure. In each case, the vector was the same: vishing—voice phishing—used to compromise Salesforce environments via OAuth abuse. While it is important to clarify that the Brinks Home breach was strictly a corporate IT event—your home alarm system and physical security devices were not affected—the fallout is massive. We are talking about 4.9 million records, including customer support chat logs, leaked after the company refused to pay a ransom.
The scope is staggering. Microsoft’s security blog documented ShinyHunters campaigns targeting over 1,000 organizations—1.5 billion records claimed—using vishing to trick employees into authorizing attacker-controlled OAuth apps disguised as Salesforce Data Loader tools. The Brinks Home attack followed the same playbook: vishing targeting a Microsoft Entra account, detected a week after initial access.
If you think this is just a temporary spike, the data suggests otherwise. According to Mandiant’s M-Trends 2026 report, vishing officially overtook email phishing as the top initial intrusion vector in 2025. The CrowdStrike 2025 Global Threat Report noted a 442% surge between the first and second half of 2024. By Q1 2025, Cisco Talos reported that vishing accounted for over 60% of their phishing incident response engagements. Attackers have realized that while firewalls are getting smarter, the human instinct to trust a voice on the other end of the line remains a massive, unpatched vulnerability.
Here is where it gets uncomfortable for the smart home industry. Google launched “Let Google Call” in November 2025, powered by Duplex. The AI agent calls local businesses to check pricing or availability on your behalf. It identifies itself as automated. The business is expected to engage. We are essentially training the world to accept and trust incoming calls from non-human entities—the exact same social trust mechanism that vishing exploits.
Call it the agent calling trust paradox. Voice phishing is the adversarial mirror of these new AI calling features. Both depend on voice-based trust at scale to function. If we normalize the idea that an AI agent should be calling us—or that we should be calling businesses via an agent—we are validating the very social engineering tactics currently tearing through corporate IT departments. If these agents inherit the ability to use voice, they inevitably inherit the liability that comes with it.
This is happening against a backdrop of deep, structural distrust. Research shows that 64% of American consumers already do not trust major platforms. Klaviyo’s 2026 AI Consumer Trends report found that only 13% of people completely trust AI. Financially, the cost is clear: companies are rushing to deploy agents for efficiency while ignoring the price of eroding the last line of defense—human skepticism.
The Brinks Home breach proves that when a human trusts a voice, the financial and reputational consequences are measured in millions of records. If the industry continues building systems that rely on voice-based identity verification without addressing the trust deficit underneath, it is not just building better tools. It is building a larger, more lucrative playground for attackers. The vulnerability is not a feature gap. It is structural—and no amount of encryption can fix it if the human on the other end is conditioned to say “yes.”