Betterment data breach might be worse than we thought

**Executive summary:** Betterment disclosed a January 2026 incident in which an attacker leveraged social engineering to access a third‑party customer communications platform, abused it to send cryptocurrency phishing messages, and exfiltrated contact, identity and sensitive financial/retirement plan data for an estimated 1.4 million customers (with a sampled CSV containing detailed records for ~181,487 people); the ransomware/extortion group Shiny Hunters claims the theft and publication of the data.