Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsCustomer Data InvolvedMulti-Stage ChainIdentity (basic)Government IDFinancial accountMediumContained

LPL FINANCIAL LLC

bd_a770fe6ece79659a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 20, 2025

Filed

Apr 27, 2026

To disclose

23 weeks

Affected

4state residents only

Linked

5 filings

Confidence

67%

Full breach record for LPL FINANCIAL LLC →37 incidents on file

LPL Financial LLC notified the NH Attorney General of a cybersecurity incident where malware distributed via phishing messages affected financial advisors' devices, leading to unauthorized third-party access to client accounts. Between Nov 20-25, 2025, LPL detected unauthorized securities transactions. Investigation confirmed no sensitive PII was accessed, but 4 NH residents were notified as a precaution. LPL restored accounts, secured systems, and offered 2 years of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d23 weeks discovery → filing

Incident timeline

discovery → filing · 23 weeks / 158 days

Nov 20, 2025

Discovered

Apr 27, 2026

Filed

vs. sector median

+14 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_a8353a63355898c82026-04-22 · +5dVerified
Maine State AGbd_df923b8f910900012026-04-22 · +5dVerified
New Hampshire State AGbd_941f183dd20500152026-05-20 · +23dVerified by operator
New Hampshire State AGbd_23641c5817d6e6632026-07-06 · +70dVerified by operator

Name: LPL FINANCIAL LLC
norm: lpl financial
Domain: lplfinancial.com

Name: LPL FINANCIAL LLC
norm: lpl financial
Domain: lplfinancial.com
Industry: Financial Servicesllm

Discovered: Nov 20, 2025
Materiality determined: —
Notification sent: Apr 27, 2026
Affected individuals: 4state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: phishing_link

During the incident: Eliminated the unauthorized access
Restored any impacted accounts to their original financial positions
Secured all affected accounts
Implemented new technical safeguards to strengthen its existing security controls
Worked with a leading forensic firm to analyze the scope of the intrusion
Contacted law enforcement for assistance with the investigation
Offering all individuals whose personal information may have been viewable two years of credit monitoring and identity protection services
Changes made: Implemented new technical safeguards to strengthen its existing security controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(158 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 3 states

View merged incident ↗

Massachusetts State AGApr 22 · first

Maine State AGApr 22 · first

New Hampshire State AG+5d · this page

New Hampshire State AG+28d

New Hampshire State AG+75d

Pattern: first filing Apr 22 (MA), last Jul 6 (NH) — a 75-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/lpl-financial-20260427.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 27, 2026
Raw hash: 5b66aba463fd228c798476074e31fb5dc65cb0f357a4abcabf7f9c66b0702028

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityLPL FINANCIAL LLC

Victim entityLPL FINANCIAL LLC

Incidentdiscovered Nov 20, 2025

Stated responseEliminated the unauthorized access

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov