MalwareFinancial ServicesFinancePhishingRansomwareTargetedData ExfiltratedIdentity (basic)Financial accountMediumContained

LPL FINANCIAL LLC

bd_df923b8f91090001 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 20, 2025

Filed

Apr 22, 2026

To disclose

22 weeks

Affected · nationwide

1,5812 in this filing

Linked

5 filings

Confidence

65%

Full breach record for LPL FINANCIAL LLC →40 incidents on file

LPL Financial LLC reported a cybersecurity incident where malware distributed via phishing messages compromised advisor devices, leading to unauthorized access to client accounts. The breach affected 1,581 individuals, including 2 in Maine. Unauthorized transactions occurred between Nov 10-25, 2025. LPL notified law enforcement, engaged forensic experts, and offered 24 months of credit monitoring. No evidence of ongoing compromise was found.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Nov 20, 2025 → Filed with AG Apr 22, 2026153d ⏱ ME AG >30d22 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 10 days

discovery → filing · 22 weeks / 153 days

Nov 10, 2025

Begins

Nov 20, 2025

Discovered

Apr 22, 2026

Filed

vs. sector median

+14 wks slower

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_a8353a63355898c82026-04-22Verified
New Hampshire State AGbd_a770fe6ece79659a2026-04-27 · +5dVerified
New Hampshire State AGbd_941f183dd20500152026-05-20 · +28dVerified by operator
New Hampshire State AGbd_23641c5817d6e6632026-07-06 · +75dVerified by operator

Name: LPL FINANCIAL LLC
norm: lpl financial
Domain: lplfinancial.com
Industry: Financial Services

Name: LPL FINANCIAL LLC
norm: lpl financial
Domain: lplfinancial.com
Industry: Financial Services
Industry: Financial Servicesllm

Discovered: Nov 20, 2025
Breach occurred: Nov 10, 2025 – Nov 25, 2025
Undetected for: 10 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 27, 2026
Affected individuals: 1,581state + nationwide
Data types: Identity (basic)Financial account
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: contacted law enforcement
Initial access: phishing_link

During the incident: Promptly contacted law enforcement
Launched an investigation, with assistance from outside experts
Took steps to stop the unauthorized activity
Restore any impacted accounts to their original financial positions
Secure all affected accounts
Implemented new technical safeguards to strengthen our existing security controls
Engaged outside information security and technology experts to assist in our review and investigation of the incident
Changes made: Implemented new technical safeguards to strengthen our existing security controls
Engaged outside information security and technology experts to assist in our review and investigation of the incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 weeks(153 days from discovery to filing)
Compliance flags: ME AG >30d · 153dME resident >60d · 158d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Nov 20, 2025
→ Filed with AG: Apr 22, 2026
153d 30 days (soft) ME AG >30d
Maine
Discovered: Nov 20, 2025
→ Notified: Apr 27, 2026
158d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Nov 20, 2025 → Filed with AG: Apr 22, 2026	153d	30 days (soft)	ME AG >30d
Maine	Discovered: Nov 20, 2025 → Notified: Apr 27, 2026	158d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 3 states

View merged incident ↗

Massachusetts State AGApr 22 · first

Maine State AGApr 22 · first · this page

New Hampshire State AG+5d

New Hampshire State AG+28d

New Hampshire State AG+75d

Pattern: first filing Apr 22 (MA), last Jul 6 (NH) — a 75-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/46dcb839-7c89-46d0-a92c-8c366003f231.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 22, 2026
Raw hash: 22096a14bec8a8219d21e33b26da2705515523662da212ee8685dfd27ccd6019

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityLPL FINANCIAL LLC

Victim entityLPL FINANCIAL LLC

Incidentdiscovered Nov 20, 2025

Stated responsePromptly contacted law enforcement

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov