AccidentalFinancial ServicesFinanceMisdeliveryCustomer Data InvolvedSupply Chain (3P Vendor)Identity (basic)Government IDFinancial accountMediumContained

LPL FINANCIAL LLC

bd_1b9a1f1a64c6e74b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 12, 2019

Filed

Mar 12, 2019

To disclose

28 days

Affected · nationwide

141 in this filing

Linked

2 filings

Confidence

66%

Full breach record for LPL FINANCIAL LLC →37 incidents on file

LPL Financial LLC notified the NH Attorney General of a security incident involving its third-party vendor, Broadridge Financial Solutions. Between July 10, 2018, and January 8, 2019, Broadridge inadvertently transferred AssetMark account data for 14 LPL clients to another broker-dealer. The receiving broker-dealer deleted the data. One New Hampshire resident was affected, with PII including SSN, DOB, and account numbers. LPL notified the individual and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 217 days

discovery → filing · 28 days

Jul 10, 2018

Begins

Feb 12, 2019

Discovered

Mar 12, 2019

Filed

vs. sector median

4 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_7fe6fea0e9831a802019-03-11 · +1dVerified

Name: LPL FINANCIAL LLC
norm: lpl financial
Domain: lplfinancial.com

Name: LPL FINANCIAL LLC
norm: lpl financial
Domain: lplfinancial.com
Industry: Financial Servicesllm

Discovered: Feb 12, 2019
Breach occurred: Jul 10, 2018 – Jan 8, 2019
Undetected for: 217 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 11, 2019
Affected individuals: 14state + nationwide
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1074 Data StagedT1041 Exfiltration Over C2 Channel
Threat actor: Partner
Regulator citations: Notified New Hampshire Office of the Attorney General
Third party: via Broadridge Financial Solutions, Inc.
Initial access: trusted_relationship

During the incident: Began working with Broadridge to ensure the data was secure
Started investigation to determine the scope of the information involved
Mailed notification letter to affected individual
Offered complimentary one-year membership in credit monitoring and identity theft protection service
Changes made: Continue to work with Broadridge to evaluate ways to enhance its policies and procedures for its data transfers
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGMar 11 · first

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/lpl-financial-20190312.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 12, 2019
Raw hash: 8c0c6e29502898a0bc3a4efbe1981a505b16f8d02cfdfd5b73a592269d0dfc84

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityLPL FINANCIAL LLC

Victim entityLPL FINANCIAL LLC

Incidentdiscovered Feb 12, 2019

Stated responseBegan working with Broadridge to ensure the data was secure

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov