HackingFinancial ServicesFinanceStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDPIIMediumContained

LPL FINANCIAL LLC

bd_e84a40ef8b955b81 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 1, 2018

Filed

Jan 17, 2019

To disclose

11 weeks

Affected

756state residents only

Linked

9 filings

Confidence

66%

Full breach record for LPL FINANCIAL LLC →37 incidents on file

LPL Financial LLC notified the Montana Attorney General of a data breach involving its third-party provider, Capital Forensics, Inc. An unauthorized individual accessed a CFI user account on a file-sharing system on November 1, 2018, potentially exposing client names, LPL account numbers, and Social Security numbers. LPL secured the account, removed data, and began notifying 756 Montana residents starting November 17, 2018, offering two years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 11 weeks / 77 days

Nov 1, 2018

Discovered

Jan 17, 2019

Filed

vs. sector median

+3 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

New Hampshire State AGbd_e5caf5bf46247a542019-01-23 · +6dVerified
New Hampshire State AGbd_035fe324c7a65d902018-11-30 · +48dVerified
New Hampshire State AGbd_16b6cb0b51a24a252018-11-19 · +59dVerified
South Carolina State AGbd_78490b8402d50ca72018-11-19 · +59dVerified

Show 4 more filings ↓up to 62d gap

Oregon State AGbd_0b991770e333c0872018-11-17 · +61dVerified
California State AGbd_3497087925c6a5a22018-11-17 · +61dVerified
Massachusetts State AGbd_63c74960da51c65e2018-11-16 · +62dVerified
Washington State AGbd_66ea226045eb8d612018-11-16 · +62dCandidate

Name: LPL FINANCIAL LLC
norm: lpl financial
Domain: lplfinancial.com

Name: LPL FINANCIAL LLC
norm: lpl financial
Domain: lplfinancial.com
Industry: Financial Servicesllm

Discovered: Nov 1, 2018
Materiality determined: —
Notification sent: Nov 17, 2018
Affected individuals: 756state-resident count only
Data types: Identity (basic)Government IDPII
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Notified Montana Office of the Attorney General
Third party: via Capital Forensics, Inc.
Initial access: valid_credentials

During the incident: Secured the CFI user’s account
Launched an investigation
Coordinated with CFI to ensure that the LPL data, including client information, was removed from that file-sharing system
Conducted a thorough review of the files
Implemented heightened monitoring on the LPL accounts involved
Notified law enforcement
Arranged for individuals to receive two years of complimentary credit monitoring and identity protection services from AllClear ID
Established a dedicated call center
Changes made: Implemented heightened monitoring on the LPL accounts involved
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(77 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 7 states

View merged incident ↗

Massachusetts State AGNov 16 · first

Washington State AGNov 16 · first

Oregon State AG+1d

California State AG+1d

New Hampshire State AG+3d

South Carolina State AG+3d

New Hampshire State AG+14d

Montana State AG+62d · this page

New Hampshire State AG+68d

Pattern: first filing Nov 16 (MA), last Jan 23 (NH) — a 68-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/lpl.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 17, 2019
Raw hash: 085092d384fb7e8ed3647a156db4f0da27cbf23c737d3b7e18bd5e69b94c9dd5

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityLPL FINANCIAL LLC

Victim entityLPL FINANCIAL LLC

Incidentdiscovered Nov 1, 2018

Stated responseSecured the CFI user’s account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov