Key Points
- Investment platform Betterment was hacked on January 9. Hackers accessed personal information, including names, emails, and phone numbers.
- The attackers then sent a fraudulent crypto scam email to customers.
- Betterment says no customer accounts or passwords were compromised.
- The company has been criticized for hiding the security incident page from search engines.
The automated investment platform Betterment has confirmed that hackers breached some of its systems last week, gaining access to the personal information of an unknown number of customers. The company sent an email to its users on Monday, explaining that the attack happened on January 9 and was the result of a “social engineering” scheme.
The hackers reportedly targeted “third-party platforms” that Betterment uses for marketing and operations. They obtained customer names, email addresses, phone numbers, and dates of birth.
With this information, the attackers then sent a fraudulent email to Betterment users. The email was a classic crypto scam, promising to triple the value of their holdings if they sent $10,000 to a wallet controlled by the hackers.
Betterment says it detected the attack on the same day it happened and “immediately revoked the unauthorized access.” The company has launched an investigation with the help of a cybersecurity firm and has started contacting the customers who were targeted.
In its email, Betterment stressed that “no customer accounts were accessed and that no passwords or other log-in credentials were compromised.” However, the company has not said how many customers were affected by the breach.
Adding to the concern, the security incident page on Betterment’s website contains a hidden “noindex” tag. This tag tells search engines like Google to ignore the page, making it much harder for people to find information about the data breach. Betterment has not yet responded to requests for more details about the attack.
