Betterment Data Breach via Compromised Third-Party Marketing Platform Used for Crypto Scam Emails

Betterment confirmed a data breach after an attacker used access to a third-party platform supporting Betterment’s marketing/operations to send fraudulent crypto “reward” messages to customers. The intrusion occurred on January 9 via a social engineering/phishing-style attack against the third-party service, enabling the threat actor to distribute emails that appeared to originate from Betterment infrastructure and lured recipients with a promise to “triple” cryptocurrency sent to an attacker-controlled wallet.

Betterment stated the attacker accessed customer PII visible within the compromised system—names, email addresses, postal addresses, phone numbers, and dates of birth—but that customer accounts, passwords, and login credentials were not compromised and Betterment’s core infrastructure was not impacted. The company reported detecting the activity the same day, revoking the unauthorized access, and engaging an external cybersecurity firm to investigate; affected customers were advised to ignore the scam message (reported as sent from support@e.betterment.com with the subject line “We’ll triple your crypto! (Limited Time)”).