USUnited States · PA · vanguard.com · Vanguard Group, Inc.
Vanguard Group (PA, United States) notified the Vermont Attorney General, the California Attorney General, the Texas Attorney General and the Iowa Attorney General of a data breach on 4 November 2026. It affected 14,000,000 records.
What we know as of
Status
Confirmed: on record with the Vermont Attorney General, the California Attorney General, the Texas Attorney General and the Iowa Attorney General.
People affected
14,000,000 records.
What was exposed
Social Security numbers, Financial account and card details, Dates of birth, Names and Addresses.
When
Began 29 July 2026, first reported 4 November 2026.
How
Hacking.
Vanguard Group’s record
No earlier breach on record under this name.
Not known yet: who was behind it. This page is updated as notices and statements come in.
Every fact above has its source below. Journalists: free to quote with credit (“Privacy Unpacked data breach tracker”, with a link to this page and the date); the figures can move. Follow this breach (feed) · Every major breach · Ask us for a figure
People affected
14,000,000records
Reported
4 November 2026Official notice and 4 more
Time to tell
98 daysfrom 29 July 2026 · the median is 147
What was exposed 5
Social Security numbers
Financial account and card details
Dates of birth
Names
Addresses
How it happened
How
Hacking in October 2026, hackers targeted Vanguardsource
Confirmed breach, 14,000,000 records (ClassAction.org)
What the letter says
Began
Vanguard experienced a social engineering incident between July 29-31, 2026.
Exposed
Some of those files contained personal information associated with certain Vanguard clients.
Offered
We have arranged to offer you three years of complimentary Credit Monitoring, $1 Million Identity Fraud Loss Reimbursement, Fraud Consultation, and Identity Theft Restoration services through a third party.
Official notices are read by code from the regulator’s own register. News reports are read by an AI model; every fact taken from an article was checked word for word against it, and anything it could not find was dropped. More notices to Vermont, California, Texas, Iowa. · Corrections and changes
Questions about the Vanguard Group breach
Was Vanguard Group hacked?
Vanguard Group (PA, United States) notified the Vermont Attorney General, the California Attorney General, the Texas Attorney General and the Iowa Attorney General of a data breach on 4 November 2026. It affected 14,000,000 records. How it happened, by the sources: hacking.
What data was exposed in the Vanguard Group breach?
Social Security numbers, Financial account and card details, Dates of birth, Names and Addresses, by the notices and reports on this page.
How do I know if I was affected?
Organisations normally tell the people whose data was involved, by letter or email, and that notice says what of yours was in it. The letter it filed is on this page. We cannot look up individual people. If you got a notice, check that it is real, then follow the steps on this page.
Is there a Vanguard Group data breach settlement?
No settlement open for claims is on record for Vanguard Group as of 15 November 2026. A settlement usually comes a year or more after a breach, if a court approves one. Every open settlement is listed with its deadline.
Is a letter, email or text about the Vanguard Group breach real or a scam?
A real notice names the breach, says what data was involved and never asks for a password, a code or a payment. Criminals often send fake notices after a breach is in the news. Do not use links or phone numbers in the message: go to Vanguard Group’s own site, or check the letter here.
Privacy Unpacked