Betterment investment advisor reports data breach, crypto scam notification
Learn More
Betterment, a digital investment advisor, reports that attackers broke into its systems on January 9, 2026.
The breach started with a social engineering attack against third-party platforms the company uses for marketing and operations. Betterment detected the intrusion the same day and stopped the unauthorized access.
The company hired an outside security firm to investigate the event and claims that its core systems and user accounts remain secure.
The attackers used their access to send fake notifications to Betterment users through the official mobile app and email channels. These messages tried to trick people into a cryptocurrency scam by promising to triple the value of Bitcoin or Ethereum deposits. The fraudulent offer claimed users could receive up to $30,000 if they sent $10,000 to a specific wallet within a three-hour window. Betterment has told users to ignore these messages and confirmed that the promotion was fake.
The company claims no one accessed actual customer accounts or stole passwords but the attackers did reach sensitive personal data stored within the compromised marketing tools. The compromised data includes:
- Full customer names
- Email addresses
- Postal addresses
- Phone numbers
- Dates of birth
The number of affected individuals is not disclosed.
Betterment posted a notice on its website but added a "noindex" tag to the page's code. This tag prevents search engines from showing the page in search results, making the breach harder for the public to find.
Affected users should monitor their accounts for suspicious activity and be careful of phishing attempts.
Update - As of 5th of February 2026, Have I Been Pwned (HIBP) claims a cyberattack on Betterment affected roughly 1.4 million users. HIBP says the dataset tied to the attack contains approximately 1.4 million unique email addresses, and partial personal information that aligns with details reported by Betterment. The company has not publicly confirmed how many customers were affected by January's incident.
