Betterment: social engineering into third-party marketing tools, 1.4 million customers’ data, scam crypto messages sent

What happened

• Betterment detected unauthorized access to internal systems on 9 Jan 2026; its 3 Feb update says contact details were exposed and some users’ mailing addresses, phone numbers or dates of birth. HIBP counted 1,435,174 unique emails (about 1.4M). Betterment says accounts, passwords and login credentials were not exposed.
• Root cause per Betterment: a social engineering scheme based on impersonation that reached third-party marketing and operations tools, used to send customers a fraudulent crypto promotion.
• ShinyHunters told The Register it voice-phished Okta SSO codes and claimed 20 million records (unverified).
• Customer updates issued.

Sources

• https://haveibeenpwned.com/Breach/Betterment
• https://www.theregister.com/2026/02/05/betterment_hack/

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.