Vanguard Data Breach: SSNs Exposed, What Is Confirmed

Vanguard Group, Inc., the US investment firm, reported a security breach to the Vermont Attorney General on 4 November 2026. The filing covers 94 Vermont residents and lists one category of data: Social Security numbers. Vanguard has not published a total. Its notice letter says a social-engineering incident between 29 and 31 July 2026 gave a third party access to files in cloud-based applications "like Microsoft 365", and it told the Independent Vanguard Adviser it is notifying "a couple hundred thousand clients". Separately, a seller on an underground forum claims about 14 million Vanguard records; Vanguard has not confirmed that, and at least one class action has been filed.

Timeline

What Vanguard has said

The fullest account is Vanguard's own sample notice letter, filed with the California Attorney General. It says: "Vanguard experienced a social engineering incident between July 29-31, 2026. Social engineering campaigns work when an imposter targets an employee, posing as a legitimate contact, and deceives the employee into providing access to their corporate accounts. In this case, the incident resulted in a third party gaining unauthorized access to certain files within a limited set of cloud-based applications, like Microsoft 365." It adds that "No client accounts were accessed", that there is no evidence of access to Vanguard's recordkeeping system "or any system that provides the ability to move money", no evidence of malware or ransomware, and that Vanguard has been coordinating with law enforcement. The affected data "varied by affected individual". Vanguard offers three years of Kroll credit monitoring, $1 million identity fraud loss reimbursement, fraud consultation and identity theft restoration, with an activation deadline printed on each letter.

We found no press release on Vanguard's own site. A second-hand account adds scale: Jeff DeMaso of the Independent Vanguard Adviser wrote on 11 November that Vanguard called the incident "social engineering", that the attacker got into a "cloud-based business application", that those affected are a small percentage of clients, mostly participants in workplace retirement plans such as 401(k)s, that no client accounts were accessed and operations were not disrupted, and that letters offering free credit monitoring were going out.

The Vermont list does not link the notice itself: Vermont stopped posting third-party PDFs for accessibility reasons, and says a copy of the sample consumer notice can be requested from AGO.SecurityBreach@vermont.gov. California posts sample notices, and that is where we read Vanguard's letter; Massachusetts also has one on file.

Vanguard's earlier incidents, and those of other large fund managers and banks, are in the Breach Index entry for Vanguard.

The 14 million claim

The 14 million figure comes from a forum listing, not from Vanguard. As relayed by ThreatMon, the listing was titled "Database [investor.vanguard.com] +14M" and its samples looked like logs of SMS verification codes, which would be records of text messages rather than 14 million people. No actor or forum was named, nobody has verified the data, and Vanguard has not said whether it is linked to the incident it reported. A record count in a sales listing is often inflated, and "records" are not people. The lawsuit quotes the 14 million figure, which is how it reached the headlines.

The lawsuits

Law360 reported on 9 November that Peppard v. The Vanguard Group, a putative class action in Pennsylvania federal court, claims Vanguard "did not take adequate steps to prevent the theft of 14 million customer records", and that the plaintiffs say the attack "has been advertised on a dark web forum". ThinkAdvisor's headline refers to class actions in the plural, and posts say three have been filed, one alleging that Social Security numbers were neither encrypted nor redacted. We could not read those complaints, so treat both points as reported, not confirmed. Several other law firms say they are only investigating. Separate lawsuits against Vanguard over website tracking are a different matter.

Why the encryption point matters if it holds: most US state breach laws treat encrypted data differently, and a complaint that says sensitive numbers sat unencrypted is arguing that a basic control was missing. Whether that is true here is for the court record to show.

If you got a letter

First, check it is real. Breach news brings fake breach letters, emails and calls. Do not use a phone number or link from an email. The genuine letter lists a dedicated call center, (844) 301-0144, and enrolment at Enroll.krollmonitoring.com/redeem, as filed with the California Attorney General; you can also call Vanguard on the number on its own website. Our Data Breach Notice Decoder pulls the data types, dates, monitoring offer and deadline out of a letter you paste, in your browser, and lists what the letter does not say.

Then protect the Social Security number. The SSN Exposure Action Plan builds the steps in order:

• Freeze your credit at Equifax, Experian and TransUnion. It is free and stops new accounts being opened in your name; lift it when you apply for credit.
• Get an IRS Identity Protection PIN so nobody can file a tax return with your number.
• Enrol in the three years of Kroll monitoring before the deadline on your letter; it tells you about misuse, it does not prevent it.
• Check your credit reports at AnnualCreditReport.com, and if you see accounts you did not open, follow the recovery plan at IdentityTheft.gov.
• Expect follow-up scams: calls "from Vanguard" or a "settlement administrator" asking you to confirm your number, and emails about the lawsuit. If you are unsure, look up the court-approved settlement website yourself rather than calling a number you were given.

Vanguard says accounts were not accessed, but it costs little to check your Vanguard account for changed contact details or bank instructions and to turn on the strongest sign-in protection it offers.

What security leaders should take from it

• An employee talked into giving access, then files in Microsoft 365 is what Vanguard described. Check which business applications hold customer identifiers, who can export from them, and whether help-desk or vendor staff can be talked into granting access. The third-party breach response checklist covers the vendor side.
• Do not store or move what you do not need. If a complaint can say Social Security numbers sat unredacted in a business application, ask where full numbers exist in your estate and whether the last four digits would do.
• Know your notification clocks. State deadlines, regulators and the SEC's rules for public companies each run their own clock: the breach notification clock calculator lays them out.
• Rehearse the customer side. Our customer database breach lab walks through the first days after customer records leave the building.

FAQ

Was Vanguard hacked in 2026?

Vanguard reported a data breach. Its notice letter, filed with the California Attorney General, says a social-engineering incident between July 29 and 31, 2026 let a third party into files in a limited set of cloud-based applications, like Microsoft 365, and that no client accounts were accessed. Its Vermont filing, dated 4 November 2026, lists Social Security numbers for 94 Vermont residents.

How many people were affected by the Vanguard data breach?

Vanguard has not published a total. Vermont's list shows 94 Vermont residents. Vanguard told the Independent Vanguard Adviser it is notifying "a couple hundred thousand clients". A seller on an underground forum claims about 14 million records; that figure is not confirmed and records are not the same as people.

What data was exposed in the Vanguard breach?

Vermont's list gives one category: Social Security numbers. Vanguard's sample letter says the data "varied by affected individual" and may include "additional details associated with your plan"; each letter names the person's own data elements. Vanguard says it has no indication the information was specifically targeted.

Is the 14 million Vanguard record leak real?

It is a claim. Around 16 October 2026 the monitoring account ThreatMon relayed a forum listing titled "Database [investor.vanguard.com] +14M", with samples that look like SMS verification-code logs. Vanguard has not confirmed it, nobody has verified it independently, and it has not been shown to be the same incident Vanguard reported to Vermont.

Is there a Vanguard data breach class action?

Yes, at least one. Law360 reported on 9 November 2026 that Peppard v. The Vanguard Group was filed as a putative class action in Pennsylvania federal court. Posts say three suits have been filed and that one alleges the Social Security numbers were not encrypted or redacted; we could not confirm either from the court records or the complaints.

What should I do if I got a Vanguard breach letter?

Check the letter is genuine by calling Vanguard on the number on its own website, not one in an email. Then freeze your credit at Equifax, Experian and TransUnion, get an IRS Identity Protection PIN, enrol in the three years of Kroll monitoring before the deadline on your letter, and watch for calls and emails that cite the breach. Our SSN Exposure Action Plan builds the steps for you.

Sources

• Vermont Attorney General: Security Breach Notices (Vanguard Group, Inc., 11-4-2026, 94 residents, Social Security Numbers; read)
• California Attorney General: Vanguard Group Inc. breach report and Vanguard's sample notice letter (breach dates 29-31 Jul 2026; read)
• Independent Vanguard Adviser: Weekly brief, 11 Nov 2026 (Vanguard's account; read)
• Law360: Peppard v. The Vanguard Group (9 Nov 2026; read)
• ThinkAdvisor: Vanguard faces class actions over data breach (headline only; page blocked to us)
• ThreatMon on X: 14M Vanguard listing (claim; read)
• Massachusetts: Vanguard Group notice on file (exists; page blocked to us)
• International Cyber Digest post on X, 13 Nov 2026 (the tip that led to this post)