Betterment betterment.com Betterment data breach: what happened and what to do
In January 2026, attackers used social engineering to reach Betterment customer data and sent fake crypto messages. Have I Been Pwned lists 1,435,174 accounts with names, emails, phones, addresses and dates of birth.
View all 13,177 breaches- Breach date
- 9 Jan 2026
- Made public
- 9 Jan 2026
- Affected
- 1,400,000
- Data exposed
- Names, Email addresses, Geographic locations, Dates of birth, Phone numbers, Physical addresses, Employers, Job titles, Device information
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Betterment is a robo-advisor that holds people's savings and retirement money, so a breach there lands differently from one at a music site. On 9 January 2026, attackers got into customer contact data through a social engineering attack, and customers began getting fraudulent messages. Have I Been Pwned (HIBP) added 1,435,174 accounts on 5 February 2026.
What happened
Betterment described a social engineering attack, where criminals pose as legitimate people to talk their way into a system. Press reports say the access ran through third-party platforms the company uses for marketing and operations, not through its core investing systems. Betterment disclosed the attack on 12 January 2026.
The visible damage was a wave of fake notifications. Customers got messages urging them to send cryptocurrency to a wallet, with a promise of tripling the money. The messages arrived through Betterment's own channels, so it's easy to see why someone would trust one.
Sources checked: haveibeenpwned.com, crowdfundinsider.com, cyberinsider.com
Last verified against the official page:
What was exposed
HIBP lists nine data types: dates of birth, device information, email addresses, employers, geographic locations, job titles, names, phone numbers and physical addresses. Every record has an email and a name. A subset also carries a date of birth, phone number or address. HIBP quotes Betterment's disclosure notice as saying the incident did not give attackers access to customer accounts and did not expose passwords or other login credentials.
What that lets criminals do
For a financial services customer, this is a ready-made target list. Criminals know your name, your employer and job title and where you live, and they know you hold money at an investment firm. That suits targeted scams: a caller posing as Betterment support, or an email about a "suspicious withdrawal" with a link to a lookalike site.
The crypto messages show the pattern. Expect more, and expect some to reach people who have never held crypto. Betterment will not ask you to send crypto to any wallet.
Dates of birth and addresses also feed identity theft. They aren't enough alone to open most accounts, but they help with account-recovery checks at other companies.
The company's response
Betterment disclosed the incident within days and told customers about the fraudulent messages. Reports say its core infrastructure wasn't breached. Check your account activity and Betterment's own notices for anything specific to your account.
What stays exposed
Contact details can't be recalled once they're in circulation. Your best protection is a locked-down account, a credit freeze if you want one, and early suspicion of any message that mentions your investments, your balance or a problem with a transfer.
What to do if you were in it
- 1
Secure your Betterment account
Change your password to a unique one and turn on two-factor authentication. Betterment says passwords weren't exposed, but a financial account deserves the extra care.
- 2
Ignore any message that asks you to send crypto
Betterment does not ask customers to move money to a wallet. Delete those messages and report them. Log in by typing the address, not by tapping links.
- 3
Expect calls and emails posing as Betterment
Someone who knows your name, employer and address can sound convincing. Hang up and call the number on the Betterment website, or log in directly to check for notices.
- 4
Consider a credit freeze
Birth dates and addresses help identity thieves. A free freeze at Equifax, Experian and TransUnion blocks new credit in your name, and you can lift it when you need to.
- 5
Review account activity
Look at recent transfers, linked bank accounts and any changes to contact details. Report anything unfamiliar to Betterment straight away.
- 6
Check whether your email or phone is in this and other breaches
Run a free scan at serus.ai to see which breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about the next one early. It can't remove data from breach dumps, which is why the other steps here matter.
Timeline
-
The breach happened
-
The company made it public
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Betterment data breach?
HIBP lists 1,435,174 accounts. Search your email on Have I Been Pwned or run a free Serus scan. If Betterment contacted you about the incident, treat your details as exposed.
What data was exposed?
Names and email addresses for every record. Many records also carry dates of birth, phone numbers, physical addresses, employers, job titles, locations and device information.
Were passwords or accounts compromised?
Betterment's disclosure notice, as quoted by HIBP, says attackers did not get access to customer accounts and passwords weren't exposed. Still, change your password and add two-factor authentication.
Is the crypto message real?
No. The messages promising to multiply cryptocurrency were part of the attack. Do not send anything to a wallet address.
Sources
- Have I Been Pwned: Betterment
- Have I Been Pwned: Betterment Data Breach · haveibeenpwned.com
- crowdfundinsider.com/2026/01/257324-betterment-discloses-social-engineering-attack-behind-recent-data-breach-and-fraudulent-messages/
- Betterment suffers customer data breach and dissemination of fraud emails · cyberinsider.com
- theregister.com/2026/02/05/betterment_hack/
- cyberinsider.com/betterment-data-breach-impacted-1-4-million-customer-accounts/
- techradar.com/pro/security/top-investment-platform-hit-in-data-breach-over-1-4-million-betterment-accounts-exposed
- identitytheft.gov/databreach
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- consumer.ftc.gov/articles/credit-freezes-and-fraud-alerts
Something wrong or out of date? Tell us and we'll re-check it.
What changed
- Page text rewritten to be clearer; the no-passwords statement is now attributed to Betterment's own disclosure notice, as Have I Been Pwned quotes it.
