---
title: "Vanguard cloud-application intrusion"
description: "Vanguard reported social-engineering access to corporate cloud files during July 29–31, 2026, while excluding client-account access."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-13"
canonical_url: "https://www.ally.security/incidents/vanguard-cloud-application-intrusion-2026"
markdown_url: "https://www.ally.security/incidents/vanguard-cloud-application-intrusion-2026.md"
stix_url: "https://www.ally.security/incidents/vanguard-cloud-application-intrusion-2026/stix.json"
---

# Vanguard cloud-application intrusion

Vanguard reported social-engineering access to corporate cloud files during July 29–31, 2026, while excluding client-account access.

Last modified Nov 13, 2026 · 1 source

## Summary

- **Environment:** Corporate cloud applications
- **Operational impact:** Vanguard reported no service disruption
- **Financial impact:** No confirmed incident cost quantified

## What happened

[Vanguard](https://www.vanguard.com/) said an imposter deceived an employee into providing corporate-account access during July 29–31, 2026. The actor reached files in a limited set of cloud applications, including [Microsoft 365](https://www.microsoft.com/microsoft-365). [1](#source-1)

## Impact

Some files contained client personal information. Vanguard said client accounts were not accessed and found no evidence of access to recordkeeping or money-movement systems. The [notification sample](https://oag.ca.gov/system/files/ELN-28726%20Vanguard%20Group%20Ad%20CM%203y%20L2%20r7prf.pdf) leaves individual data fields unspecified. [1](#source-1)

## Timeline

### July 29, 2026 — Incident interval begins

Vanguard dates the social-engineering incident to July 29–31. [1](#source-1)

### July 31, 2026 — Reported interval ends

The notice does not give a separate detection date. [1](#source-1)

### November 13, 2026 — Briefing updated

This briefing was last reviewed and updated on November 13, 2026.

## Threat Group & Attack Vector

The notice establishes deception and corporate-account access, without identifying the communication channel used. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- [T1078 — Valid Accounts](https://attack.mitre.org/techniques/T1078/): the actor gained access to employee corporate accounts. [1](#source-1)

## Response

Vanguard contained the activity, used outside experts, coordinated with law enforcement and strengthened monitoring and training. It reported no associated malware or ransomware and offered three years of monitoring. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/vanguard-cloud-application-intrusion-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Vanguard cloud-application incident notification sample

official · Vanguard Group Inc.

<https://oag.ca.gov/system/files/ELN-28726%20Vanguard%20Group%20Ad%20CM%203y%20L2%20r7prf.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Began At · 100% confidence · current**  
   Vanguard cloud-application intrusion: 2026-07-29
2. **Resulted In · 100% confidence · current**  
   Vanguard cloud-application intrusion: Vanguard described social engineering during July 29–31, 2026: an imposter deceived an employee into providing access to corporate accounts, allowing access to files in a limited set of cloud applications such as Microsoft365.
3. **Resulted In · 100% confidence · current**  
   Vanguard cloud-application intrusion: Vanguard contained the activity and reported no evidence of ongoing unauthorized access, malware or ransomware associated with this incident.
4. **Resulted In · 100% confidence · current**  
   Vanguard cloud-application intrusion: Social-engineering incident begins
5. **Resulted In · 100% confidence · current**  
   Vanguard cloud-application intrusion: Some accessed files held client personal information. Individual data fields and the impact-determination date are placeholders in the public template; no total affected population is stated.
6. **Ended At · 100% confidence · current**  
   Vanguard cloud-application intrusion: 2026-07-31
7. **Affected Organization · 100% confidence · current**  
   Vanguard cloud-application intrusion: Vanguard Group Inc.
8. **Occurred At · 100% confidence · current**  
   Reported incident interval ends: 2026-07-31
9. **Used Attack Technique · 100% confidence · current**  
   Vanguard cloud-application intrusion: https://attack.mitre.org/techniques/T1078/
10. **Resulted In · 100% confidence · current**  
   Vanguard cloud-application intrusion: Reported incident interval ends
11. **Occurred At · 100% confidence · current**  
   Social-engineering incident begins: 2026-07-29
12. **Resulted In · 100% confidence · current**  
   Vanguard cloud-application intrusion: Vanguard said client accounts were not accessed and services were not disrupted. It found no evidence of access to its recordkeeping or money-movement systems.
13. **Resulted In · 100% confidence · current**  
   Vanguard cloud-application intrusion: Vanguard used outside cybersecurity experts, coordinated with law enforcement and strengthened monitoring and employee training. It offered three years of credit and identity monitoring.

</details>