Vanguard Data Breach

The Vanguard Group told Vermont regulators that a data breach involved Social Security numbers. Weeks earlier, someone claimed online to be selling more than 14 million Vanguard records.

The Vanguard Group, Inc., the investment management company based in Malvern, Pennsylvania, reported a data breach to the Vermont Attorney General on November 4, 2026. The filing lists 94 Vermont residents and names Social Security numbers as the type of information involved. The Vermont register does not say how the breach happened, when Vanguard found it, or when letters went out.

Source: Vermont Attorney General, Security Breach Notices

A 94-Person Filing and a 14 Million Record Claim

In mid-October 2026, a post on an underground forum claimed to offer a database tied to investor.vanguard.com with more than 14 million records, according to the threat intelligence account ThreatMon. ThreatMon reported that the sample rows appeared to be logs of text-message verification codes Vanguard sent to clients. A verification code is the one-time number a company texts to confirm a login. The sample timestamps ran from June to August 2026.

ThreatMon noted that the claim had not been independently verified. As of November 10, 2026, Vanguard has not publicly confirmed the forum claim. Vanguard also has not said whether the Vermont filing and the forum post describe the same event. They could be connected, or they could be separate incidents.

Law360 reported on November 9, 2026 that a proposed class action filed in Pennsylvania federal court alleges Vanguard failed to protect 14 million customer records, including Social Security numbers. The claims in that lawsuit have not been proven.

Vanguard has not disclosed the total number of people affected. The Vermont filing confirms at least 94 people so far.

Sources: ThreatMon; Law360, “Vanguard Failed To Protect 14M Customer Records, Suit Says”

What Information Was Exposed?

Confirmed in the Vermont filing:

• Social Security numbers

Claimed in the October forum post, not verified:

• Logs of text-message verification codes, with timestamps, countries and mobile carriers, according to ThreatMon

What Is Vanguard Offering Affected Investors?

Vanguard has not publicly posted a notice letter, and the Vermont register does not include one. Vanguard has not disclosed whether it is offering credit monitoring. People who receive a letter should check it for any monitoring offer, enrollment code and deadline.

Your Information Is at Risk

Social Security numbers do not expire. A thief with one can open credit, file a false tax return or apply for benefits in another person’s name, sometimes years later. Investment accounts also hold retirement savings, which makes them a target. Scammers often use breach news to send fake texts or calls that ask for a login code or account details.

Affected individuals can:

• Freeze credit at Equifax, Experian and TransUnion.
• Review Vanguard account activity and statements for anything unfamiliar.
• Treat any unexpected call or text asking for a verification code as a likely scam.
• Request an Identity Protection PIN from the IRS.
• Keep any notice letter received from Vanguard.

Do You Have Legal Options?

Investment firms that collect Social Security numbers have a legal duty to protect them and to give timely notice when a breach occurs. When that duty is not met, affected individuals may have legal rights and remedies. Emery | Reddy is investigating the Vanguard data breach. No Fee Unless We Recover.

Contact Emery | Reddy today at 916.995.5968 for a Free Case Review.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

FAQ

How many people were affected by the Vanguard data breach?

Vanguard has not disclosed a total. Its Vermont filing lists 94 Vermont residents. An October forum post claimed more than 14 million records, but that claim has not been verified.

What information was exposed?

• Social Security numbers (confirmed in the Vermont filing)
• Text-message verification code logs (claimed in the forum post, not verified)

Is the 14 million record claim connected to the Vermont filing?

That is not known yet. Vanguard has not said whether the two are the same event.

Has a lawsuit been filed?

Yes. Law360 reported on November 9, 2026 that a proposed class action has been filed in Pennsylvania federal court. The claims have not been proven.

What should I do if I have a Vanguard account?

• Freeze your credit with all three credit bureaus.
• Check your account activity and statements.
• Never share a verification code with someone who contacts you.
• Keep any letter you receive from Vanguard.

Someone texted me about the Vanguard breach. Is it real?

It may not be. Scammers often use breach news to send fake messages. Do not click links or share codes. Contact the company using the phone number on your statement or its official website.

What can someone do with my Social Security number?

A thief can use it to open credit cards or loans, file a false tax return, or apply for benefits in your name. Because a Social Security number does not change, the risk can last for years.

Do I have a legal claim?

Companies that collect sensitive information have a duty to protect it and to tell people promptly when it is exposed. If you have a Vanguard account and received a notice, or believe your information was involved, you may have legal options. Contact Emery | Reddy at 916.995.5968 or visit www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.