Vanguard Group Data Breach Exposes Social Security Numbers

Vanguard Group Inc, an investment management company that offers mutual funds, exchange-traded funds, brokerage services, retirement plans and financial advice, disclosed a data breach.

Between July 29 and July 31, 2026, Vanguard experienced a social engineering incident. As a result of the incident, a third party gained unauthorized access to certain files stored within a set of cloud-based applications, including Microsoft 365.

Vanguard reported that investigators found no evidence of access to its recordkeeping system or any system that provides the ability to move money. There was also no evidence of malicious software or ransomware on Vanguard systems connected to the incident.

The types of information exposed included Social Security numbers and financial account information.

The breach was reported to the attorneys general offices of California, Massachusetts and South Carolina beginning on Nov. 11, 2026. So far, the incident impacted 1,656 South Carolina residents and 1,224 Massachusetts residents. Affected consumers were notified by written notice.

Vanguard Group's response to the breach

Vanguard is offering affected individuals three years of complimentary identity monitoring services through Kroll, which the company described in its notification as a global leader in risk mitigation and response.

Affected individuals received a unique activation code and verification ID in their written notice and can enroll in the monitoring services at Kroll's enrollment page. Additional information about the monitoring services is available at Kroll's information page.

The company also set up a dedicated call center for affected individuals at 844-301-0144, available Monday through Friday from 9:00 a.m. to 9:00 p.m. Eastern Time, excluding major U.S. holidays.