Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsTargetedIdentity (basic)MediumResolved

Betterment Holding Company LLC

bd_60f10ab38308822c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 9, 2026

Filed

Mar 27, 2026

To disclose

11 weeks

Affected

2,750state residents only

Linked

3 filings

Confidence

71%

Full breach record for Betterment Holding Company LLC →

Betterment LLC reported an unauthorized access incident on Jan 9, 2026, caused by social engineering. The actor accessed customer names. Betterment removed access, completed an investigation, and offered credit monitoring. 2,750 Washington residents were affected. Notification was sent March 27, 2026.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d11 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 11 weeks / 77 days

Jan 9, 2026

Begins

Jan 9, 2026

Discovered

Mar 27, 2026

Filed

vs. sector median

+2 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteshinyhuntersbd_c55bfe880713bb1d2025-09-28 · +179dVerified

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_137fe8f3cf8e77e42026-08-05 · +131dVerified by operator

Name: Betterment Holding Company LLC
norm: betterment holding

Name: Betterment Holding Company LLC
norm: betterment holding
Industry: Financial Servicesllm

Discovered: Jan 9, 2026
Breach occurred: Jan 9, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 27, 2026
Affected individuals: 2,750state-resident count only
Data types: Identity (basic)
Data elements: NameDate of birth
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 0dexposure 0d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Filed notification with Washington Attorney General
Initial access: phishing_link

During the incident: Identified and removed the actor’s access to our systems
Initiated an investigation into the incident
Arranged for you at your option to enroll in credit monitoring and fraud assistance at no cost
Providing proactive fraud assistance through Cyberscout
Changes made: Enhanced security posture to mitigate the risk of similar attempts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(77 days from discovery to filing)
Compliance flags: Leak >90dWA AG >30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Washington State AGMar 27 · first · this page

Massachusetts State AG+131d

Pattern: first filing Mar 27 (WA), last Aug 5 (MA) — a 131-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37496.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 27, 2026
Raw hash: 887d792b654507f160a25fc439c56e4ea36020ad08fdcc0af53ad3ff372cbc5b

Linked disclosures

Ransomware claims (1)

Regulatory filings (1) · sorted by filing gap

Reporting entityBetterment Holding Company LLC

Victim entityBetterment Holding Company LLC

Incidentdiscovered Jan 9, 2026

Stated responseIdentified and removed the actor’s access to our systems

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com