Robo-Advisor Betterment Discloses Data Breach

A threat actor breached Betterment’s systems through social engineering, with third-party software platforms used for marketing and operations implicated, and the incident was not the result of Betterment infrastructure hacking, according to Betterment. The attacker on 9 January sent a crypto-related scam message impersonating the company to certain customers to prompt deposits to cryptocurrency addresses controlled by the attacker.

After the fraudulent message, Betterment revoked the unauthorized access and launched an ongoing investigation, with the company stating that no customer accounts were accessed and no passwords or other credentials were compromised.

In a 10 January notice, the fintech firm explained that accounts were not compromised even if affected users had clicked the fraudulent links, but this week it revealed that the threat actor might have accessed certain customer information, including names, addresses, email addresses, phone numbers and dates of birth. Betterment has contacted affected customers directly and, while it did not share the number of potentially impacted individuals, SecurityWeek has been seeking further information.