Betterment data breach

In January 2026, the automated investment platform Betterment experienced a security incident resulting from a social engineering attack targeting a third-party marketing and communications platform.

What Happened

• Date of Incident: January 9, 2026

• Attack Vector: An unauthorized individual used social engineering (such as impersonation) to breach a third-party software system used by Betterment for customer communications and marketing.

• Phishing Campaign: Attackers abused the platform to send fraudulent, crypto-related promotional messages to a subset of customers, urging them to send funds to an attacker-controlled cryptocurrency wallet.

• Betterment's Response: Betterment immediately revoked the unauthorized access, launched an investigation with the cybersecurity firm CrowdStrike, and contacted affected customers to warn them to disregard the messages.

Scope and Exposed Data

• Affected Accounts: Approximately 1.4 million customer records/unique email addresses were exposed.

• Exposed Information: Names, email addresses, and geographic location data. For a subset of customers, additional PII (personally identifiable information) was accessed, including:

• Physical addresses
• Phone numbers
• Dates of birth
• Job titles and employer details
• Device information

• What Was Not Compromised: Betterment and forensic investigations confirmed that no customer investment accounts, passwords, or login credentials were accessed or compromised.

In order to protect yourself, we recommend the following:

1. Monitor your credit report for any suspicious activities. If you cannot do this yourself, make use of any service that does this on your behalf.

2. Be on the lookout for an increase in number of spam or scam calls and emails. We recommend you make use of Apps like True Caller, which can assist you in identifying any possible spam or scam calls.

3. Be sure to monitor your bank account transactions. Ensure you receive real time notifications on any transaction.