HackingStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
LPL FINANCIAL LLC
bd_3497087925c6a5a2 · schema v1 · pii pii-v1
Full breach record for LPL FINANCIAL LLC →LPL Financial LLC notified clients of a data breach involving its service provider, Capital Forensics, Inc. On November 1, 2018, an unauthorized person accessed a Capital Forensics user account on a third-party file-sharing system. Files containing LPL client information, including names, account numbers, and Social Security Numbers, were potentially accessed. LPL coordinated with Capital Forensics to remove the data and implemented heightened monitoring. Affected individuals are offered two years of complimentary credit monitoring and identity protection services.
California clockDiscovered Nov 1, 2018 → Notified Nov 17, 201816d ✓ CA 60-day OK16 days discovery → filing
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_0b991770e333c087Oregon State AGfiled 2018-11-17Verified
- bd_66ea226045eb8d61Washington State AGfiled 2018-11-16(1d gap)Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-141893
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 17, 2018
- Raw hash
- 483d640e6f67f2db27e492118fa9d9aa8da6401e0038ed6cb47ce94c3a87c0cf
Reporting entity
- Name
- LPL FINANCIAL LLCnorm: lpl financial
- Domain
- lplfinancial.com
Victim entity
- Name
- LPL FINANCIAL LLCnorm: lpl financial
- Domain
- lplfinancial.com
Incident
- Discovered
- Nov 1, 2018
- Materiality determined
- —
- Notification sent
- Nov 17, 2018
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Third party
- via Capital Forensics, Inc.
- Initial access
- trusted_relationship
Compliance
- Time to disclose
- 16 days(16 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 16d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Nov 1, 2018→ Notified: Nov 17, 201816d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.