Betterment betterment.com Betterment data breach: what happened and what to do
In January 2026, attackers used social engineering to reach Betterment customer data and sent fake crypto messages. Have I Been Pwned lists 1,435,174 accounts with names, emails, phones, addresses and dates of birth.
View all 13,115 breaches- Breach date
- 9 Jan 2026
- Affected
- 1,435,174
- Data exposed
- Dates of birth, Device information, Email addresses, Employers, Geographic locations, Job titles, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Betterment is a robo-advisor that holds people's savings and retirement money, so a breach there lands differently from one at a music site. On 9 January 2026, attackers got into customer contact data through a social engineering attack, and customers began receiving fraudulent messages. Have I Been Pwned (HIBP) added 1,435,174 accounts on 5 February 2026.
What happened
Coverage of the disclosure says Betterment described a social engineering attack, where criminals impersonate legitimate identities to talk their way into a system. Reports say the access ran through third-party platforms the company uses for marketing and operations, not through its core investing systems. Betterment disclosed the attack on 12 January 2026.
The visible damage was a wave of fake notifications. Customers received messages urging them to send cryptocurrency to a wallet with a promise of tripling the money. Anyone who saw a message like that could reasonably have taken it for a Betterment message, since it arrived through the company's own channels.
What was exposed
HIBP lists nine data types: dates of birth, device information, email addresses, employers, geographic locations, job titles, names, phone numbers and physical addresses. HIBP notes that every record has an email and a name, and that a subset also carries a date of birth, phone number or address. Secondary reports say Betterment stated that passwords and other login credentials were not exposed and that attackers did not gain access to customer accounts. That claim comes from press coverage, not from a notice reviewed directly.
What that lets criminals do
For a financial services customer, this is a good target list. Criminals know your name, your employer and job title, and where you live, and they know you hold money at an investment firm. That combination suits targeted scams: a caller pretending to be Betterment support, or an email about a "suspicious withdrawal" with a link to a lookalike site.
The crypto messages show the pattern. Expect more of them, and expect some to be aimed at people who have never held crypto. Betterment will not ask you to send crypto to any wallet.
Dates of birth and addresses feed identity theft. They are not enough alone to open most accounts, but they help with account-recovery checks at other companies.
The company's response
Betterment disclosed the incident publicly within days and told customers about the fraudulent messages. Reports say its core infrastructure was not breached. Check your account activity and Betterment's own notices for anything specific to your account.
What stays exposed
Contact details cannot be recalled once they are in circulation. The practical protection is a locked-down account, a credit freeze if you want one, and early suspicion of any message that mentions your investments, your balance or a problem with a transfer.
What to do if you were in it
- 1
Secure your Betterment account
Change your password to a unique one and turn on two-factor authentication. Reports say passwords were not exposed, but financial accounts deserve extra care.
- 2
Ignore any message that asks you to send crypto
Betterment does not ask customers to move money to a wallet. Delete those messages and report them. Log in by typing the address, not by tapping links.
- 3
Expect calls and emails posing as Betterment
Someone who knows your name, employer and address can sound convincing. Hang up and call the number on the Betterment website, or log in directly to check for notices.
- 4
Consider a credit freeze
Birth dates and addresses help identity thieves. A free freeze at Equifax, Experian and TransUnion blocks new credit in your name, and you can lift it when you need to.
- 5
Review account activity
Look at recent transfers, linked bank accounts and any changes to contact details. Report anything unfamiliar to Betterment straight away.
- 6
Check whether your email or phone is in this and other breaches
Run a free scan at serus.ai to see which breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about the next one early. It can't remove data from breach dumps, which is why the other steps here matter.
Frequently asked
Was I affected by the Betterment data breach?
HIBP lists 1,435,174 accounts. Search your email on Have I Been Pwned or run a free Serus scan. If Betterment contacted you about the incident, treat your details as exposed.
What data was exposed?
Names and email addresses for every record. Many records also carry dates of birth, phone numbers, physical addresses, employers, job titles, locations and device information.
Were passwords or accounts compromised?
Reports say Betterment stated that passwords were not exposed and attackers did not access customer accounts. Still, change your password and add two-factor authentication.
Is the crypto message real?
No. The messages promising to multiply cryptocurrency were part of the attack. Do not send anything to a wallet address.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
