Wealthfront · Breach

Actor claims to sell 800K Wealthfront customer records

Nov 05, 2026 · 1 min read

A threat actor on a Russian-language forum claims to sell a database of about 800,000 Wealthfront customer records, a US investment fintech, with names, emails, phone numbers, birthdates and home addresses. The listing cites November 1, 2026 as the breach date and asks $800; the claim is unverified and Wealthfront has not commented. Customers should expect convincing phishing using real details and keep MFA enabled.

By HIFY Radar newsroom Updated 11/05/2026 06:57 AM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A threat actor on a Russian-language forum claims to sell a database of about 800,000 Wealthfront customer records, a US investment fintech. The data would include names, emails, phone numbers, birthdates and home addresses. The claim is unverified and Wealthfront has not commented.

Why it matters

If confirmed, exposure of this data makes investment-platform customers prime targets for support-call scams and account takeover. The $800 asking price is low and raises the risk of targeted phishing. So far it is only a threat-actor claim, with no breach confirmation.

What to do

Await Wealthfront's response and monitor for independent confirmation. Warn customers about support calls and emails using real details, reinforce MFA, and instruct them to never share codes by phone.

For the technical team

Affected: Wealthfront, plataforma norte-americana de robo-advisor e fintech; base alegada com cerca de 800 mil registros de client · Database attributed to the Wealthfront platform (US robo-advisor and fintech); about 800,000 customer records.
Exploitation: Sale claim on a Russian-language forum, reported by DailyDarkWeb. No independent verification and no comment from Wealthfront.
Fix: No fix applicable; this is an alleged data leak.
Vector: Alleged data breach; sources give no invasion vector or compromised system. The listing cites November 1, 2026 as the breach date.
More details: Data claimed in the listing: names, emails, phone numbers, birthdates and home addresses. Asking price: $800. DailyDarkWeb notes investment-platform customers are prime targets for account takeover and support-call scams, with convincing phishing using real details.