HackingFinancial ServicesFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedTargetedIdentity (basic)Government IDMediumContained

LPL FINANCIAL LLC

bd_40792ff0b36bbf0f · schema v1 · pii pii-v2

Severity

Medium

Discovered

Sep 30, 2025

Filed

Dec 26, 2025

To disclose

—

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Full breach record for LPL FINANCIAL LLC →37 incidents on file

LPL Financial LLC reported a cybersecurity incident between September 30 and October 10, 2025, where foreign threat actors gained unauthorized access to affiliated financial advisors' online accounts. The actors executed a 'hack pump-and-dump' trading scheme and may have viewed clients' personal information, including names, addresses, and government IDs. LPL contacted law enforcement, secured accounts, and offered 24 months of credit monitoring via TransUnion. The incident is contained.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d

Incident timeline

Sep 30, 2025

Begins

Sep 30, 2025

Discovered

Dec 26, 2025

Filed

This filing is one of 2 about the same incident.View merged incident

A leak claim by cephalus about this victim predates this filing by 121 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecephalusbd_a7104fdbf86491432025-08-26 · +121dVerified by operator

Name: LPL FINANCIAL LLC
norm: lpl financial
Domain: lplfinancial.com

Name: LPL FINANCIAL LLC
norm: lpl financial
Domain: lplfinancial.com
Industry: Financial Servicesllm

Discovered: Sep 30, 2025
Breach occurred: Sep 30, 2025 – Oct 10, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: contacted law enforcement
Initial access: valid_credentials

During the incident: Contacted law enforcement
Launched an investigation, with assistance from outside experts
Took steps to stop the unauthorized activity
Restore any impacted accounts to their original securities holding positions
Secure all affected accounts
Implemented new technical safeguards to strengthen our existing security controls
Engaged outside information security and technology experts
Changes made: Implemented new technical safeguards to strengthen our existing security controls
Offering a complementary 24-month membership for credit monitoring and identity theft protection services through TransUnion
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/5afa09e1-8fae-424f-97aa-d74fe8c70a28.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 26, 2025
Raw hash: f72eea78fc51823b2a0127ee1f05d3c09f1bf5f9f01bbe8fe7130902d2c899cc

Linked disclosures

Ransomware claims (1)

Reporting entityLPL FINANCIAL LLC

Victim entityLPL FINANCIAL LLC

Incidentdiscovered Sep 30, 2025

Stated responseContacted law enforcement

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancenebraska.gov