Robo-advisor pioneer Betterment has disclosed a cybersecurity incident after a threat actor used social engineering to breach its systems.
The attack involved third-party software platforms that the company uses for marketing and operations and was not the result of Betterment infrastructure hacking, the investment advisor said.
The threat actor on January 9 sent a crypto-related message to certain Betterment customers, impersonating the company to trick users into sending them funds.
The fraudulent message claimed that Betterment would triple fresh deposits made to Bitcoin and Ethereum cryptocurrency addresses controlled by the attacker.
“After the fraudulent message was sent on January 9, our teams immediately revoked the unauthorized access and launched a comprehensive investigation, which is ongoing,” Betterment said.
The company says it has contacted the affected customers directly to notify them of the scam.
According to Betterment, no customer accounts were accessed in the attack, and no passwords or other credentials were compromised.
In a January 10 notice, the fintech firm explained that no accounts were compromised even if the affected users clicked on the links in the fraudulent message.
This week, however, Betterment revealed that the threat actor might have accessed certain customer information, including names, addresses, email addresses, phone numbers, and dates of birth.
“We encourage all customers to remain vigilant and to be cautious of unexpected communications. Please remember that Betterment will never call, text, or email you with a request to share your password or other sensitive personal information,” the company said.
What Betterment did not share was the number of potentially impacted individuals. SecurityWeek has emailed the company for additional information and will update this article if it responds.
Headquartered in New York City, Betterment is one of the largest robo-advisors in the US, with over 1 million customers and more than $65 billion worth of assets under management.
Related: After Goldman, JPMorgan Discloses Law Firm Data Breach
Related: Instagram Fixes Password Reset Vulnerability Amid User Data Leak
Related: Researcher Spotlights WhatsApp Metadata Leak as Meta Begins Rolling Out Fixes
Related: European Space Agency Confirms Breach After Hacker Offers to Sell Data
