Betterment Says Social Engineering Attack Enabled Data Breach and Unauthorized Messages
Investing and savings app Betterment said Monday (Jan. 12) that a social engineering attack led to its customers receiving an unauthorized message promoting a crypto-related promotion and to an unauthorized individual gaining access to customer information.
Betterment had told its customers Friday (Jan. 9), in the first security update about the incident, that they may have received a message about the promotion earlier in the day and that the message was not real and should be disregarded.
The company said the unauthorized message was sent via a third-party system it uses for customer communications.
In a Saturday (Jan. 10) update, Betterment said an unauthorized individual gained access to some of the company’s systems and was thereby able to claim to represent Betterment while sending the fraudulent promotion.
The company said that the unauthorized access had been removed, there was no sign that the individual gained access to Betterment customer accounts, and the security of those accounts was not compromised if customers clicked on the notification offer.
In its Monday update sharing that the incident was enabled by a social engineering attack, Betterment said this means “the individual used identity impersonation and deception to gain access, rather than compromising our technical infrastructure.”
The company said that the unauthorized access involved third-party platforms it uses to support its marketing and operations, that it launched an ongoing investigation, and that a leading cybersecurity firm will help with that investigation.
It added that while no customer accounts were accessed and no log-in credentials were compromised, it believes the unauthorized individual accessed customer information such as names, email addresses, physical addresses, phone numbers and birthdates.
Betterment said that it will provide more details when it is able and that customers should be cautious of unexpected communications and should remember that Betterment will never ask them to share their password or sensitive personal information.
The company added that it is “reviewing and strengthening our controls and training to further protect against social engineering attempts.”
The PYMNTS Intelligence report “Vendors and Vulnerabilities: The Cyberattack Squeeze on Mid-Market Firms“ found that social engineering attacks are a growing problem for middle-market companies.
Another PYMNTS Intelligence report, “The State of Fraud and Financial Crime in the U.S. 2024: What FIs Need to Know,” found that social engineering fraud had increased 56% in the previous year.
The FBI’s Internet Crime Complaint Center (IC3) cautioned the public in November that cybercriminals are impersonating financial institutions to steal money or information from individuals, businesses and organizations.
The post Betterment Says Social Engineering Attack Enabled Data Breach and Unauthorized Messages appeared first on PYMNTS.com.