Betterment customer-data theft led to fraudulent crypto offers
An intruder stole Betterment contact data and sent customers a fake crypto offer. Betterment says customer accounts and passwords were not compromised. Ignore the offer and report suspicious contact through Betterment’s official channels.
Ignore the fraudulent crypto offer and verify unexpected messages by opening Betterment’s app or website yourself. If you sent money or suspect fraud, contact [email protected]. Betterment says no account changes are required.
What’s happening
An intruder used social engineering to access Betterment’s marketing and operations applications on 9 January. Betterment says data associated with approximately 1.4 million customers and business contacts was stolen, mostly names and email addresses. Some records also contained postal addresses, phone numbers or birthdates. The access enabled a fraudulent crypto promotion promising to multiply money sent to the attacker. Betterment removed access that day. Its investigation subsequently confirmed that customer accounts and login details were not compromised. The investigation ended in March, with victims reimbursed and staff security controls strengthened. The stolen data was published online; removal of the hosting site does not establish that copies were recovered.
- What
- Breach
- Affects
- Betterment investment service and customer communications
- Fixed in
- Nothing to patch
- Since
- 9 Jan 2026
- Closed
- 30 Mar 2026
Timeline
- Vendor revised
Betterment announced its completed investigation. It reported reimbursing scam victims, notifying customers with more sensitive data exposed, and strengthening staff authentication and monitoring.
- Vendor revised
Betterment confirmed that customer accounts, passwords and login information were not compromised. Some contact records also contained addresses, phone numbers or birthdates; its privacy assessment continued.
- Update
Criminals published stolen data online. Betterment later said the site hosting it had been removed.
- Update
A flood of traffic disrupted Betterment’s website and app. Full service returned at 19:40 UTC; Betterment said customer account security was unaffected.
- Update
A criminal group demanded cryptocurrency. Betterment consulted law enforcement and decided against engaging with the group.
- Made public
Betterment emailed all customers about the incident and opened its update page. It warned that names, email addresses, postal addresses, phone numbers and birthdates might have been accessed.
- Wider attacks
The intruder sent a fake crypto offer to approximately 460,000 customers through email and mobile notifications. Betterment stopped access and warned recipients that day.
- UpdateNothing to patch
Social engineering gave an intruder access to a Betterment employee’s account and marketing and operations applications.
Sources
- Security Incident Report: January 2026Betterment · 30 Mar 2026
- Updates on Betterment January 9 Security IncidentBetterment · 30 Mar 2026
- Data breach at fintech firm Betterment exposes 1.4 million accountsBleepingComputer · 5 Feb 2026
- Fintech firm Betterment confirms data breach after hackers send fake crypto scam notification to usersTechCrunch · 12 Jan 2026