SoFi

Documented events with consequences still open. Each entry carries a source and a date.

1. Dec 29, 2025 Data breach Severe ✓ resolved

   Social engineering against the bank's internal systems: name, date of birth, contact details and employment data of at least 38,049 customers exfiltrated between 31 December and 3 January — national total never disclosed

   The source is the breach notification SoFi itself filed with the Washington State Attorney General on 26 January 2026, signed by Valerie Franch, Associate General Counsel, Privacy, «on behalf of SoFi Bank, N.A., and Social Finance, LLC». Official wording: «On or around January 2, 2026, SoFi discovered unauthorized activity in its systems, which occurred as a result of social engineering». So not a technical exploit: someone was granted access. What was taken, in the notification's words: «name, address, email address, phone numbers, date of birth, and employment and education information of approximately 38,049 state residents» were «acquired by the unauthorized actor». What was not taken, which SoFi also puts in writing in the customer letter: «this scammer never had access to your password, account number(s), or debit/credit card number(s)». No member accounts were compromised and, as of the notification date, there were «no reports of fraud, identity theft, or compromises of consumer accounts» linked to the incident. ⚠️ The number to read carefully: 38,049 counts Washington State residents only, because that is the one figure that state's law compels. **SoFi has never made a national total public.** Estimates between 500,000 and 1.6 million customers circulate online: they come neither from SoFi nor from a recognised outlet, and so are not written here as fact. The certain figure is 38,049 in a single state, and the overall order of magnitude remains undisclosed. Timeline, from the Attorney General's official record: unauthorized access between 29 December 2025 and 2 January 2026, data exfiltrated between 31 December and 3 January, notification on 26 January — within the 30 days required. «No unauthorized activity has been observed since January 3, 2026». SoFi says it engaged CrowdStrike and other outside advisors and notified law enforcement; for customers it applied «additional monitoring and other safeguards» on accounts, with the practical consequence that it may ask for extra information from anyone contacting support or trying to change their account. 📌 One thing is missing, and it shows: the notification **offers no credit monitoring service** to those affected. The attachment is limited to generic instructions on obtaining your own free credit report and placing a fraud alert or freeze with Equifax, Experian and TransUnion. On a breach exposing date of birth and employment data, that is a choice the user pays for out of pocket.

   ↗ source
2. Apr 30, 2026 Data breach Moderate ● open

   Unauthorized access to a database at the SoFi Securities (Hong Kong) subsidiary through a third-party vendor: vendor, customer count and data categories never disclosed

   ⚠️ Perimeter first: this breach concerns **SoFi Securities (Hong Kong) Limited**, the subsidiary offering investment and securities services to customers in the Asian region, not the US neobank described in this entry — which operates in the US only. It is here because it is the group's second confirmed security incident in four months, not because it touches users of the American account. The facts: SoFi confirmed unauthorized access to a database at SoFi Securities (Hong Kong) Limited that occurred **through a third-party vendor**. Discovery is dated 30 April 2026; customer notification and press coverage come on 8 June 2026. The company said it engaged external cybersecurity professionals and advised customers to enable two-factor authentication, monitor their accounts and stay alert to phishing attempts. What was not said is the most relevant part, and is recorded as such: SoFi **did not disclose the vendor's name**, **did not state how many customers were involved**, did not list the categories of data exposed, and declined to answer further questions. At the time of disclosure it stated: «We do not yet have complete information about the scope and impact of the incident». No definitive count has been published since, nor the start date of the unauthorized access: this is why the date on the entry is that of **discovery**, the only certain one. The incident stays open for that reason, not because something is happening right now: without a figure and without the data categories, a Hong Kong customer has no basis to know whether they are among those affected.

   ↗ source

verified on Oct 1, 2026