Betterment and CarGurus Data Breach Claims Involving Stolen Customer and Corporate Records

Fintech platform Betterment reported a January 2026 social-engineering incident in which an employee was tricked into providing credentials that enabled unauthorized access to internal messaging systems via third-party tools. Betterment said it detected and contained the access the same day, launched an external forensic investigation, and later indicated the incident affected roughly 1.4 million customers; exposed data included names, email addresses, and location data broadly, with a smaller subset including phone numbers, physical addresses, dates of birth, job titles, and device details. Betterment stated that no financial accounts, logins, or passwords were accessed, but warned that the stolen PII was used to send crypto-scam messages impersonating Betterment to pressure users into transferring funds.

Separately, the extortion group ShinyHunters claimed it stole 1.7 million CarGurus corporate records and threatened to leak the data if the company did not engage by a stated deadline; the criminals alleged the haul included PII and internal corporate data, and CarGurus had not publicly confirmed the claim at the time of reporting. The same reporting tied the CarGurus claim to a broader run of ShinyHunters-related leak-site postings and extortion threats against other organizations, with at least one victim (Canada Goose) indicating that data recently published online may have been historical rather than from a new intrusion.