In January 2026, Betterment experienced a security incident caused by a social engineering attack that resulted in unauthorized access to certain third-party systems used for marketing and operations. The incident led to fraudulent crypto-related messages being sent to customers and the exposure of customer contact and demographic data, but did not compromise customer accounts, passwords, or login credentials.
Severity: Critical
Core Security Incident (January 9)
- Cause: An unauthorized individual gained access through social engineering (identity impersonation and deception) rather than a technical breach of Betterment’s infrastructure.
- Impacted Systems: The access involved third-party software platforms used for marketing and operations.
- Immediate Result: The attacker sent fraudulent, crypto-related messages to a subset of customers. These messages promised high returns if funds were sent to an attacker-controlled wallet.
- Scope of Data Exposure: Approximately 1.4 million unique email addresses were exposed.
- Exposed data included names, emails, and geographic location data.
- In some cases, physical addresses, phone numbers, birthdates, device information, and job titles were also accessed.
- Account Security: Investigations confirmed that no customer accounts, passwords, or login information were compromised.
Secondary Incident: Ddos Attack (January 13)
- Timing: Starting at 9:04 AM ET on January 13, Betterment experienced intermittent outages.
- Cause: A distributed denial-of-service (DDoS) attack involving high volumes of internet traffic.
- Outcome: Some customers had difficulty logging in, but the attack did not affect account security.
- Resolution: Partial access was restored by 10:25 AM ET, and full services were back by 2:40 PM ET that same day.
Response From Betterment
- Implement mandatory identity verification procedures for access requests involving third-party platforms, including call-back verification and secondary approvals.
- Enforce out-of-band verification for any changes or access related to customer communications systems.
- Conduct regular social engineering simulations (impersonation, pretexting, phishing) targeting employees and contractors with access to third-party tools.
- Apply least-privilege access to all third-party marketing and operational platforms, ensuring users only have permissions required for their role.
- Require MFA enforcement across all third-party systems, including SaaS marketing, CRM, and messaging platforms.
Source:
- https://haveibeenpwned.com/Breach/Betterment
- https://www.betterment.com/customer-update
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.
