Cyber Incident Victim: LPL Financial
Date:
Nov 2018
Location:
United States of America
Summary
A cybersecurity incident involving a third-party vendor, Capital Forensics, Inc., exposed sensitive personal information of certain investors affiliated with LPL Financial. An unauthorized individual accessed a file-sharing system used by the vendor, compromising data including names, addresses, Social Security numbers, and account numbers. The breach was detected and contained within six hours of initiation. LPL implemented enhanced account monitoring for affected individuals and coordinated with the vendor to provide complimentary credit monitoring and identity protection services. All impacted parties were notified, with the vendor conducting an investigation and reinforcing security measures to prevent future incidents.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On November 1, 2018, an unauthorized individual gained access to a third-party file-sharing system used by Capital Forensics, Inc. (CFI), a vendor providing document production and data analysis services to LPL Financial. The intrusion was detected by CFI four hours after it began, with containment measures completed within six hours of initial discovery. The compromised system contained files with personally identifiable information of investors associated with CFI's clients, including LPL Financial. Exposed data included investor names, addresses, Social Security numbers, and account numbers. CFI confirmed the breach affected multiple clients but not all clients served by the vendor. The specific method of unauthorized access and total number of affected individuals were not disclosed in available reports.
LPL Financial notified its financial advisors about the incident on November 9, 2018, confirming their limited use of CFI's services and the exposure of investor data through the vendor's system. The firm implemented heightened monitoring of affected investor accounts to detect potential fraudulent activity and coordinated with CFI to provide complimentary credit monitoring and identity protection services to impacted individuals. Notification letters were mailed directly to affected investors. CFI stated it had notified all affected clients and was conducting a thorough investigation while taking steps to enhance security protections for its client base. No information regarding potential extortion or ransom demands was confirmed in available reporting, and CFI did not respond to specific media inquiries about the attack vector or scope of data exposure.