Loading story…
SoFi Hong Kong disclosed a potential data breach after unauthorized access was detected in a database maintained by a third-party vendor for SoFi Securities (Hong Kong) Limited. The company said it discovered the incident on April 30 and has retained an external cybersecurity firm to investigate the scope and impact, but it has not yet confirmed what categories of customer information were exposed, how many customers were affected, or the identity of the vendor involved.
The firm warned customers to remain alert for phishing, suspicious communications, and unusual account activity while the investigation continues. SoFi said it has added extra safeguards and monitoring to affected accounts and may require additional verification for support requests or account changes, while advising customers to change passwords, enable two-factor authentication, and closely monitor financial accounts.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
SoFi Hong Kong notified customers of the potential breach and advised them to watch for phishing, suspicious communications, and unusual account activity, while changing passwords, enabling two-factor authentication, and monitoring financial accounts. The company also said it added extra safeguards and monitoring to affected accounts and may require additional verification for support interactions or account changes.
After discovering the incident, SoFi Hong Kong engaged an external cybersecurity firm to investigate the breach involving its third-party vendor environment. At the time of disclosure, the company said it still had not confirmed what customer data was exposed, how many customers were affected, or the vendor's identity.
SoFi Hong Kong said it discovered on 2026-04-30 that an unauthorized party had accessed a database maintained by a third-party vendor for SoFi Securities (Hong Kong) Limited. The company said it had not yet determined the full scope or impact of the incident.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Betterment** disclosed that a **social engineering** attack against a **third-party platform account** used for customer communications enabled unauthorized access to internal systems in early January, leading to the exposure of personal data tied to **1,435,174 accounts**. The intruder used the access to send **fraudulent crypto-themed promotional messages** impersonating Betterment and promising to “triple” cryptocurrency sent to attacker-controlled wallets (including **Bitcoin and Ethereum** addresses). Betterment said it revoked the unauthorized access the same day it was detected, warned customers to ignore the messages, and initiated a forensic investigation with external incident-response support. Breach analysis and indexing by **Have I Been Pwned** indicated the exposed dataset included **email addresses, names, and location data**, with reporting also citing additional PII such as **dates of birth, physical addresses, phone numbers, device information, and employment-related details**. Betterment stated there is **no evidence** that customer investment accounts were accessed or that **passwords/authentication tokens** were compromised, characterizing the incident as an exposure of contact/identity data rather than account credentials. Separate reporting noted Betterment also experienced **intermittent outages attributed to a DDoS attack and extortion attempts** around the same period, but this was described as distinct from the social-engineering-driven data exposure.
Jun 29, 2026
Bits of Gold, Israel’s largest regulated cryptocurrency broker, disclosed a data breach after attackers gained unauthorized access through a third-party vendor system tied to a broader software supply-chain incident. The Tel Aviv-based firm said the compromise may have affected about **200,000 customers** and exposed personal and financial information including names, national ID numbers, email addresses, contact details, IP addresses, bank account numbers, and public cryptocurrency wallet addresses. The company said there is no indication it was specifically targeted and reported that **passwords, private keys, scanned IDs, full payment card numbers, and card security codes were not exposed**. Bits of Gold isolated the affected system, notified regulators, and brought in a specialized incident response firm, while the identity of the compromised vendor and the full scope of affected customers remain under investigation; the company also said it has not yet found evidence of malicious use of the stolen data.
Aug 18, 2026
Sotheby's, a leading international auction house specializing in fine art and luxury items, experienced a significant data breach on July 24, 2025. The company confirmed that threat actors gained unauthorized access to its systems and exfiltrated sensitive data, including full names, Social Security numbers, and financial account information. The breach was detected on July 24, prompting Sotheby's to launch an immediate investigation to determine the scope and nature of the compromised data. The investigation, which lasted approximately two months, involved a thorough review of the stolen information to identify the affected individuals. According to filings with the Maine Attorney General's Office, at least two residents of Maine and two of Rhode Island were directly impacted, though the total number of affected individuals remains undisclosed. Sotheby's has not publicly identified the perpetrators behind the attack, and no ransomware group has claimed responsibility as of the latest reports. The company emphasized its ongoing commitment to cybersecurity, stating that it maintains layered defenses, strict access controls, secure connections, and advanced threat protections. Regular patching, incident response testing, vendor vetting, and workforce training are part of Sotheby's security posture. Despite these measures, the attackers were able to bypass defenses and access sensitive data. In response to the breach, Sotheby's is offering 12 months of credit and identity monitoring services through TransUnion to those affected. The company has pledged to review and enhance its security safeguards to prevent future incidents. Sotheby's has so far only reported the breach to the Maine Attorney General, with no filings found in other state data breach portals at the time of reporting. The incident follows a similar attack on Christie's, another major auction house, which was targeted by ransomware actors the previous year. Sotheby's has previously faced security incidents, including malicious code planted on its website to steal payment information. The breach highlights the ongoing risks faced by high-profile organizations handling sensitive client data, particularly those serving high-net-worth individuals. The financial and reputational impact of the breach is still being assessed, as the company continues to investigate and respond to the incident. Sotheby's has not disclosed whether an extortion demand was made or if any ransom was paid. The breach underscores the importance of robust cybersecurity measures and transparent communication with affected clients in the wake of data theft incidents.
Jun 29, 2026