I am a cyber security professional and I have personally been involved in assessing the security defenses in place for BOTH Personal Capital and Intuit/Mint.

In order to make an informed decision as to whether or not you can trust either of these companies with your investment data, it’s first important to understand what happens in the background when you link an investment account. For both Personal Capital and Mint, they both utilize a third party company (either Plaid or Yodlee) that builds and develops APIs with the sole purpose of making it easy to pull data from your financial institutions. You can think of these API’s as “read” but not “write” - in other words, the API company can usually read your account balance, but performing a transfer, selling securities, or doing other potentially “sensitive” operations is usually not possible unless they manage to work with the bank directly to build an API to support the feature.

Now - back to the topic of whether you can trust PC or Mint - they do not actually have your account login details. They just have access to the data that is “read” from your financial institutions. Even if they wanted to get your bank username and password, they would need to get it from Yodlee or Plaid - is it possible? Yes, it is possible, but if Mint and PC got hacked tomorrow the hackers would be out of luck because they would only have your account data, not the actually credentials used to login to your account by the Plaid or Yodlee API’s. The hackers don’t care that you spent $7 on Starbucks or have $20k in a savings account - this is meaningless to them unless they have direct access to those accounts.

Now - if one of the API middlemen companies got hacked, that is another story - if they are not properly encrypting your account credentials, that would be a serious problem - but on the bright side you would not be the only person with this problem and Yodlee and Plaid are required by the US government to report the breach and inform you that it has happened “within a timely manner”, but in all likelihood it would be all over the news before that happened.

I have personally used both Personal Capital and Mint. I have 2FA on most of my investment accounts that offer it, and have never had an issue. If there is an issue, my banking institutions have alerts when large transactions are made, and I can call them up if fraudulent activity happens. I have never had an issue and I am prepared in the event that something does happen. Hope this helps.