Summary
- Environment: Corporate cloud applications
- Operational impact: Vanguard reported no service disruption
- Financial impact: No confirmed incident cost quantified
- Record status: Developing record. Reviewed November 13, 2026; updated as evidence emerges.
What happened
Vanguard said an imposter deceived an employee into providing corporate-account access during July 29–31, 2026. The actor reached files in a limited set of cloud applications, including Microsoft 365. [1]
Impact
Some files contained client personal information. Vanguard said client accounts were not accessed and found no evidence of access to recordkeeping or money-movement systems. The notification sample leaves individual data fields unspecified. [1]
Timeline
Threat Group & Attack Vector
The notice establishes deception and corporate-account access, without identifying the communication channel used. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1078 — Valid Accounts: the actor gained access to employee corporate accounts. [1]
Response
Vanguard contained the activity, used outside experts, coordinated with law enforcement and strengthened monitoring and training. It reported no associated malware or ransomware and offered three years of monitoring. [1]