Vanguard data breach letter: a July 2026 social engineering incident reached client files in Microsoft 365

Date	Event
July 29 to 31, 2026	Social engineering incident; files in cloud applications accessed
November 4, 2026	Vermont records Vanguard's report (94 residents)
November 11, 2026	California attorney general posts the notice
November 12, 2026	Massachusetts records the report (1,224 residents)

What happened in the Vanguard data breach?

The letter explains the method. Social engineering, it says, works when an imposter targets an employee while posing as a legitimate contact and deceives the employee into handing over access to corporate accounts. In Vanguard's case, that access reached files kept in cloud applications, not the systems that run client accounts. Vanguard says it started its incident response protocols, contained the activity and hired outside cybersecurity experts. It says there is no evidence of malicious software or ransomware on its systems in connection with the incident. It has also been coordinating with law enforcement. The letter does not say how Vanguard became aware of the activity, or when. Social engineering in SEC 8-K filings shows how other companies have described the same entry route.

What information was exposed in the Vanguard breach?

It varies by person, and the filed letter leaves the list blank for each recipient. It adds that the data may also have included additional details associated with the recipient's plan. The state records give the categories: Social Security numbers in Vermont's record, and Social Security numbers and financial account information in Massachusetts'. Vanguard says it has no sign that anyone's information was specifically targeted.

Was my Vanguard account hacked?

Not according to the letter. It says the recipient's Vanguard account was not accessed and the incident did not disrupt Vanguard's operations or services. The files were taken from cloud applications, and Vanguard says there is no evidence the intruder reached the recordkeeping system or anything that can move money. The letter suggests turning on security codes and account activity alerts through Vanguard's Security Center. Bank, brokerage and mortgage breach notices compares what other financial firms tell their clients.

How many people were affected by the Vanguard breach?

No national total is public. These are the state counts on file:

State	Residents affected	Categories recorded	Date recorded
Massachusetts	1,224	Social Security numbers; financial accounts	November 12, 2026
Vermont	94	Social Security numbers	November 4, 2026

Why did the Vanguard letter take three months?

The incident ended on July 31, 2026, and the first state record is dated November 4: 96 days later. The letter says Vanguard worked with an outside vendor to establish the nature and scope of the affected data, and gives each person's discovery date as a placeholder. The guide to notice-letter delays puts the gap against other notices in the log.

What is Vanguard offering people who got the letter?

Three years of credit monitoring through Kroll, with $1 million in identity fraud loss reimbursement, fraud consultation and identity theft restoration. Activation is at enroll.krollmonitoring.com/redeem with the code and verification ID printed on the letter, by the deadline printed there. Vanguard's call center for the incident is (844) 301-0144, Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern. Credit monitoring offers in breach letters compares this offer with those in other letters in the log.