Social EngineeringFinancial ServicesFinancePhishingCustomer Data InvolvedIdentity (basic)Financial accountLowContained

Kestra Financial Services

bd_3f0e180479223a4d · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 18, 2024

Filed

Nov 13, 2025

To disclose

—

Affected

2state residents only

Confidence

66%

Full breach record for Kestra Financial Services →5 incidents on file

Kestra Financial notified 2 Maryland residents of a phishing incident involving unauthorized access to email accounts in Oct-Nov 2024. The company secured accounts, conducted an investigation, and provided credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 78 days

Oct 1, 2024

Begins

Dec 18, 2024

Discovered

Nov 13, 2025

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: Kestra Financial Services
norm: kestra financial
Domain: kestrafinancial.com

Name: Kestra Financial Services
norm: kestra financial
Domain: kestrafinancial.com
Industry: Financial Servicesllm

Discovered: Dec 18, 2024
Breach occurred: Oct 1, 2024 – Nov 30, 2024
Undetected for: 78 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 18, 2025
Affected individuals: 2state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Steps were taken to secure the relevant email accounts
An investigation was conducted to confirm the nature and scope of the incident
Notifying those who may be affected
Providing you with access to [Extra2] months of credit monitoring and identity protection services, through Experian
Changes made: Providing you with access to [Extra2] months of credit monitoring and identity protection services, through Experian
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376214.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 13, 2025
Raw hash: 6a7c859ffd1685a09ca4e2afe6f5455b71a2d0cc414118f45ba8d376b87de6e3

Reporting entityKestra Financial Services

Victim entityKestra Financial Services

Incidentdiscovered Dec 18, 2024

Stated responseSteps were taken to secure the relevant email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov