DisclosureLens
Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsMulti-Stage ChainWire FraudCustomer Data InvolvedFinancial accountIdentity (basic)Government IDPIIMediumContained

LPL FINANCIAL LLC

bd_a8353a63355898c8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 20, 2025

Filed

Apr 22, 2026

To disclose

22 weeks

Affected

13state residents only

Linked

5 filings

Confidence

64%
Full breach record for LPL FINANCIAL LLC →40 incidents on file

LPL Financial LLC experienced a cybersecurity incident between November 20-25, 2025, involving malware distributed through phishing messages that affected advisor devices. This led to unauthorized third-party access to advisor accounts on LPL's web-based portal, resulting in unauthorized securities transactions and financial transfers. While no evidence of sensitive personal information access was found, clients were notified out of caution. LPL contacted law enforcement, engaged outside experts, stopped the activity, restored accounts, and implemented new security safeguards. Credit monitoring was offered to affected individuals.

Massachusetts clock✗ MA AG >90d22 weeks discovery → filing

Incident timeline

discovery → filing · 22 weeks / 153 days

Nov 20, 2025

Begins

Nov 20, 2025

Discovered

Apr 22, 2026

Filed

vs. sector median

+14 wks slower

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Filing propagation · 5 filings · 3 states

View merged incident ↗
Maine State AGApr 22 · first
Massachusetts State AGApr 22 · first · this page

Pattern: first filing Apr 22 (ME), last Jul 6 (NH) — a 75-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.