{"id":"betterment-data-breach-crypto-scam-jan-2026","category":"breach","status":"closed","title":"Betterment customer-data theft led to fraudulent crypto offers","tldr":"An intruder stole Betterment contact data and sent customers a fake crypto offer. Betterment says customer accounts and passwords were not compromised. Ignore the offer and report suspicious contact through Betterment’s official channels.","summary":"An intruder used social engineering to access Betterment’s marketing and operations applications on 9 January. Betterment says data associated with approximately 1.4 million customers and business contacts was stolen, mostly names and email addresses. Some records also contained postal addresses, phone numbers or birthdates. The access enabled a fraudulent crypto promotion promising to multiply money sent to the attacker. Betterment removed access that day. Its investigation subsequently confirmed that customer accounts and login details were not compromised. The investigation ended in March, with victims reimbursed and staff security controls strengthened. The stolen data was published online; removal of the hosting site does not establish that copies were recovered.","action":"Ignore the fraudulent crypto offer and verify unexpected messages by opening Betterment’s app or website yourself. If you sent money or suspect fraud, contact fraud@betterment.com. Betterment says no account changes are required.","product":"Betterment investment service and customer communications","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["betterment","data-breach","social-engineering","crypto","phishing"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Security Incident Report: January 2026","url":"https://www.betterment.com/resources/security-incident-report-january-2026","by":"Betterment","date":"2026-03-30"},{"kind":"advisory","title":"Updates on Betterment January 9 Security Incident","url":"https://www.betterment.com/customer-update","by":"Betterment","date":"2026-03-30"},{"kind":"news","title":"Data breach at fintech firm Betterment exposes 1.4 million accounts","url":"https://www.bleepingcomputer.com/news/security/data-breach-at-fintech-firm-betterment-exposes-14-million-accounts/","by":"BleepingComputer","date":"2026-02-05"},{"kind":"news","title":"Fintech firm Betterment confirms data breach after hackers send fake crypto scam notification to users","url":"https://techcrunch.com/2026/01/12/fintech-firm-betterment-confirms-data-breach-after-hackers-send-fake-crypto-scam-notification-to-users/","by":"TechCrunch","date":"2026-01-12"}],"started":"2026-01-09","closed":"2026-03-30","created":"2026-11-03T20:23:54.797Z","updated":"2026-11-03T20:23:54.797Z","cve_notes":[],"timeline":[{"at":"2026-03-30T15:15Z","added":"2026-11-03T20:12:05.486Z","kind":"vendor-revised","text":"Betterment announced its completed investigation. It reported reimbursing scam victims, notifying customers with more sensitive data exposed, and strengthening staff authentication and monitoring.","url":"https://www.betterment.com/resources/security-incident-report-january-2026","by":"Betterment","patch":null},{"at":"2026-02-03T16:00Z","added":"2026-11-03T20:12:05.486Z","kind":"vendor-revised","text":"Betterment confirmed that customer accounts, passwords and login information were not compromised. Some contact records also contained addresses, phone numbers or birthdates; its privacy assessment continued.","url":"https://www.betterment.com/customer-update","by":"Betterment","patch":null},{"at":"2026-01-23","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Criminals published stolen data online. Betterment later said the site hosting it had been removed.","url":"https://www.betterment.com/resources/security-incident-report-january-2026","by":"Betterment","patch":null},{"at":"2026-01-13T14:04Z","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"A flood of traffic disrupted Betterment’s website and app. Full service returned at 19:40 UTC; Betterment said customer account security was unaffected.","url":"https://www.betterment.com/customer-update","by":"Betterment","patch":null},{"at":"2026-01-12T15:39Z","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"A criminal group demanded cryptocurrency. Betterment consulted law enforcement and decided against engaging with the group.","url":"https://www.betterment.com/resources/security-incident-report-january-2026","by":"Betterment","patch":null},{"at":"2026-01-12T15:00Z","added":"2026-11-03T20:12:05.486Z","kind":"disclosed","text":"Betterment emailed all customers about the incident and opened its update page. It warned that names, email addresses, postal addresses, phone numbers and birthdates might have been accessed.","url":"https://www.betterment.com/customer-update","by":"Betterment","patch":null},{"at":"2026-01-09T22:46Z","added":"2026-11-03T20:12:05.486Z","kind":"wider-attacks","text":"The intruder sent a fake crypto offer to approximately 460,000 customers through email and mobile notifications. Betterment stopped access and warned recipients that day.","url":"https://www.betterment.com/resources/security-incident-report-january-2026","by":"Betterment","patch":null},{"at":"2026-01-09T18:31Z","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Social engineering gave an intruder access to a Betterment employee’s account and marketing and operations applications.","url":"https://www.betterment.com/resources/security-incident-report-january-2026","by":"Betterment","patch":"na"}],"url":"https://hard.fyi/live/betterment-data-breach-crypto-scam-jan-2026/","json":"https://hard.fyi/api/live?id=betterment-data-breach-crypto-scam-jan-2026"}