Social-engineering attack on Vanguard cloud files exposes client SSNs
What happened. Per Vanguard’s sample letter on file with the California AG, an imposter posing as a legitimate contact deceived an employee into giving access to corporate accounts. The third party reached “certain files within a limited set of cloud-based applications, like Microsoft 365”. Vanguard says there was no malware or ransomware, the activity was contained, and it is working with law enforcement. The Independent Vanguard Adviser reports Vanguard described a “cloud-based business application” and said most people affected are workplace retirement plan participants.
Impact. Vermont: 94 residents, Social Security numbers. Vanguard’s letter says the data varied by person and “may have also included additional details associated with your plan”. Vanguard has not published a total; it told the Independent Vanguard Adviser “a couple hundred thousand clients”. No client accounts were accessed, per Vanguard. Three years of Kroll credit monitoring and $1 million identity fraud reimbursement are offered. Law360 reported a putative class action, Peppard v. The Vanguard Group, on 9 November 2026.
Sources: Vanguard sample notice letter (California AG) · California AG breach entry: Vanguard Group Inc. · Vermont AG security breach notices · Independent Vanguard Adviser, 11 Nov 2026 · Law360: Peppard v. The Vanguard Group