HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountCriticalContained

Lincoln Financial Advisors

bd_998a5c50fe6b038f · schema v1 · pii pii-v1

Severity

Critical

Discovered

Aug 17, 2009

Filed

Jan 5, 2010

To disclose

20 weeks

Affected · nationwide

1,200,0002,100 in this filing

Confidence

66%

Full breach record for Lincoln Financial Advisors →4 incidents on file

Lincoln Financial Securities Corporation (LFS) and Lincoln Financial Advisors Corporation (LFA) notified Hawaii OCP of a vulnerability in a portfolio information system involving shared usernames and passwords. FINRA alerted LFS on August 17, 2009, after receiving credentials from an unidentified source. Forensic investigation by Kroll found no evidence of unauthorized access or misuse, but could not rule it out. Approximately 1.2 million individuals were potentially affected, including 2,100 Hawaii residents. Data included names, SSNs, account numbers, and balances. Notices were sent January 6, 2010, offering credit monitoring.

J jump to incidentP pin to compareR raw source

Hawaii clock✓ HI CRA notice due20 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 20 weeks / 141 days

Aug 17, 2009

Discovered

Jan 5, 2010

Filed

vs. sector median

+12 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,200,000 affectedView incident

Name: Lincoln Financial Advisors
norm: lincoln financial advisors

Name: Lincoln Financial Advisors
norm: lincoln financial advisors
Industry: Financial Servicesllm

Discovered: Aug 17, 2009
Materiality determined: —
Notification sent: Jan 6, 2010
Affected individuals: 1,200,000state + nationwide
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Regulator citations: Notified Hawaii Department of Commerce and Consumer Affairs, Office of Consumer Protection
Initial access: valid_credentials

During the incident: Engaged Kroll Ontrack, Inc. to conduct a forensic investigation
Engaged Edwards Angell Palmer & Dodge LLP as outside counsel
Discontinued all shared usernames and passwords
Heightened enforcement of LNC policy prohibiting shared usernames and passwords
Sent voluntary notification letters to potentially affected individuals
Offered free credit monitoring services through Kroll
Offered identity theft restoration services through Kroll
Conducting a comprehensive review of client information systems for similar vulnerabilities
Changes made: Discontinued all shared usernames and passwords
Heightened enforcement of LNC policy prohibiting shared usernames and passwords
Investigating other LFS/LFA client information systems for vulnerabilities
Continually strengthening computer security policies and procedures across all IT platforms
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(141 days from discovery to filing)
Compliance flags: HI CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://web.archive.org/web/20211024101019id_/https://cca.hawaii.gov/ocp/files/2015/12/OCP-2010-0017.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 5, 2010
Raw hash: ceaf5a965e4025daa99f87cfe954208b6e7c78598ee998305a7016a808ddf909

Reporting entityLincoln Financial Advisors

Victim entityLincoln Financial Advisors

Incidentdiscovered Aug 17, 2009

Stated responseEngaged Kroll Ontrack, Inc. to conduct a forensic investigation

ComplianceHI CRA notice due

Extraction provenanceno artifact recorded

Source provenanceweb.archive.org