Almeida Law Group is investigating a data breach at LPL Financial LLC. If you were affected, contact Almeida Law Group.
About LPL Financial LLC
LPL Financial LLC is a wholly owned subsidiary of LPL Financial Holdings Inc. (Nasdaq: LPLA) and is described as the largest independent broker-dealer in the United States. The company serves over 32,000 financial advisors and approximately 8 million client families, with roughly $2.3 trillion in client assets. It provides brokerage and advisory services, clearing and compliance services, technology platforms, and practice management programs to independent financial advisors and financial institutions. LPL Financial is headquartered in San Diego, California, with major offices in Fort Mill, South Carolina; Boston, Massachusetts; Austin, Texas; New York, New York; and Tempe, Arizona.
What Happened?
LPL Financial LLC was listed in a Vermont Attorney General breach report summary dated September 14th, 2026. The filing identifies LPL Financial as a Financial Services organization and reports that the categories of data involved include Social Security Numbers, Financial Account Codes, and Credit and Debit Account Information. The Vermont AG filing does not specify the total number of persons affected or a separate breach date distinct from the report date.
It is unclear whether the September 14th, 2026 Vermont filing relates to a previously disclosed LPL incident or a new event. LPL has disclosed at least two separate cybersecurity incidents in recent years. First, in late 2025, LPL notified Maine regulators of a breach occurring between approximately September 30th and October 10th, 2025, in which foreign threat actors accessed affiliated advisors’ online accounts and used them in a hack pump-and-dump trading scheme, affecting 53 individuals. Second, in April 2026, LPL disclosed a larger breach stemming from a November 10th, 2025 incident in which malware distributed via phishing messages compromised affiliated financial advisor devices, resulting in unauthorized securities transactions and financial transfers affecting 1,581 individuals. LPL stated it discovered that unauthorized activity on November 20th, 2025, contained the intrusion, and restored impacted accounts to their original financial positions. LPL offered affected clients two years of complimentary Experian credit monitoring in connection with that incident. The Vermont AG filing is notable in that it explicitly identifies Social Security Numbers, Financial Account Codes, and Credit and Debit Account Information as the breached data categories — detail that had not been publicly specified in earlier disclosures. No ransomware group has been publicly linked to any of the LPL incidents.
Key Facts at a Glance
- Company or Organization: LPL Financial LLC
- Industry: Financial Services — Independent Broker-Dealer and Registered Investment Advisor
- Location: San Diego, California (headquartered)
- Incident type: Unauthorized access; compromised data includes Social Security Numbers, Financial Account Codes, and Credit and Debit Account Information
- Date of consumer notification: September 14th, 2026
- Identity theft protection offered: Two years of complimentary Experian credit monitoring (offered in connection with the previously disclosed November 2025 incident)
- Prior breach: Yes — at least two prior incidents disclosed in 2025–2026: a September–October 2025 pump-and-dump scheme affecting 53 individuals, and a November 2025 phishing/malware incident affecting 1,581 individuals
- Litigation status: No class action specifically related to the LPL data breaches has been identified; LPL faces separate, unrelated class action litigation in other matters
- Source: Vermont Attorney General — Security Breach Notices; WealthManagement.com; UpGuard; Massachusetts AG — LPL Financial LLC Breach Notification Letter; AdvisorHub
What Should You Do?
If you received a notice from LPL Financial, enroll in any identity theft protection or credit monitoring that was offered before the enrollment deadline passes. Because Social Security Numbers and financial account information were involved, consider placing a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion. Review your bank, brokerage, and credit card statements carefully for any transactions you do not recognize. You can request free copies of your credit reports at AnnualCreditReport.com. If you spot signs of identity theft or fraud, report them at IdentityTheft.gov, which can help you create a personalized recovery plan.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
