1. [News](/news) 2. LPL Financial Holdings data breach: what happened and what's at risk LPL Financial Holdings # LPL Financial Holdings data breach: what happened and what's at risk A data breach involving LPL Financial Holdings was reported in April 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team April 24, 2026 Table of Contents * [What happened in the LPL Financial Holdings data breach?](#what-happened-in-the-lpl-financial-holdings-data-breach) * [Who is behind the incident?](#who-is-behind-the-incident) * [Impact and risks for LPL Financial Holdings customers](#impact-and-risks-for-lpl-financial-holdings-customers) * [How to protect against similar security incidents](#how-to-protect-against-similar-security-incidents) ## Key facts: LPL Financial Holdings data breach * Date occurred November 10, 2025 * Date discovered November 20, 2025 * Date reported April 22, 2026 * Target entity LPL Financial Holdings * Source of breach Malware distributed through phishing * Status Confirmed; reported on April 22, 2026. * Severity Medium; unauthorized financial transactions were initiated, affecting over 1,500 individuals. ## What happened in the LPL Financial Holdings data breach? LPL Financial Holdings (lpl.com) reported a data breach on April 22, 2026, stemming from a security incident that took place in late 2025. The breach was triggered by malware delivered via phishing messages, which successfully compromised a limited number of devices belonging to affiliated financial advisors. This unauthorized access allowed an unidentified third party to perform unauthorized securities transactions and financial transfers involving the accounts of 1,581 individuals. The incident is classified as medium severity because it resulted in direct financial manipulation of customer accounts. LPL Financial Holdings discovered the unauthorized activity on November 20, 2025, and has since taken corrective actions to secure the compromised accounts and restore them to their original financial positions. While the company has implemented enhanced security measures, breaches involving advisor credentials typically increase the risk of targeted social engineering and identity theft for the affected parties. ## Who is behind the incident? The attacker or cause of the incident has not been identified. ## Impact and risks for LPL Financial Holdings customers The primary impact of this breach is the unauthorized access to and manipulation of financial accounts for 1,581 individuals. Although LPL Financial Holdings has worked to reverse unauthorized transfers, affected customers may still face risks such as secondary phishing attacks or credential abuse. Information gathered during the breach could potentially be used to craft highly convincing social engineering lures targeting these specific individuals in the future. Typical outcomes for financial sector breaches include the need for rigorous account monitoring and potential long-term credit protection. Affected users should immediately update their account passwords and ensure that robust multi-factor authentication is active. Regularly reviewing financial statements for any unrecognized activity is essential. Transparency regarding these incidents is vital for helping users protect their assets effectively. ## How to protect against similar security incidents Following the phishing-related breach at LPL Financial Holdings, it is critical for affected individuals to secure their financial accounts and for organizations to harden their defenses against malware. * **Implement phishing-resistant multi-factor authentication.** Utilize hardware security keys or authenticator apps rather than SMS-based codes for all financial logins. Ensure that all advisors and employees use strong, unique credentials for every internal system. Regularly audit access logs for any unusual login locations or patterns. * **Monitor financial and credit activity.** Carefully review all recent securities transactions and bank transfers for unauthorized changes. Consider placing a security freeze on credit reports to prevent unauthorized account creation. Sign up for identity theft protection and credit monitoring services to receive alerts on suspicious activity. * **Enhance endpoint security and awareness.** Deploy advanced endpoint detection and response (EDR) tools to identify and block malware execution. Conduct frequent phishing simulation training for all staff to reduce the success rate of social engineering. Maintain a rigorous patch management schedule to close vulnerabilities that malware might exploit. > Proactive monitoring and the adoption of a comprehensive attack surface management strategy are essential for mitigating the risks posed by modern cyber threats. ## Frequently asked questions ### What happened in the LPL Financial Holdings security breach? On April 22, 2026, LPL Financial Holdings (lpl.com) disclosed a security breach. According to initial reports, the incident involved unauthorized securities transactions and financial transfers affecting 1,581 individuals after malware was distributed through phishing messages to affiliated financial advisors. ### When did the LPL Financial Holdings breach occur? The LPL Financial Holdings breach was publicly reported on April 22, 2026. The exact date of the attack has not been disclosed, though the company identified unauthorized activity starting around November 10, 2025. ### What data was exposed? The types of data involved in the LPL Financial Holdings incident have not been disclosed. This page will be updated as verified information becomes available. ### Is my personal information at risk? If you interacted with LPL Financial Holdings, there’s a possibility your personal information could be affected. Similar incidents often involve email addresses, login details, or financial records. Stay alert for updates and take precautionary measures to secure your accounts. ### What steps should companies take after being breached? LPL Financial Holdings has secured affected accounts, restored them to their original financial positions, and enhanced their security measures. They have also notified the relevant authorities and may provide guidance on protective actions to affected individuals. ## Is your organization exposed to a similar risk? UpGuard continuously monitors vendors for exposed credentials and infrastructure risk, so you can catch the next breach before it becomes a headline. [Start your free trial](https://cyber-risk.upguard.com/register/trial) ## How secure is LPL Financial Holdings? LPL Financial Holdings operates as an independent broker-dealer and registered investment advisor platform. The company provides technology, clearing, compliance, and advisory services to independent financial advisors and financial institutions across the United States. * View our free preliminary report on LPL Financial Holdings's security posture * 13 risk factors, including email security, SSL, DNS health, open ports and common vulnerabilities [View LPL Financial Holdings's score View score](/security-report/lpl-financial-holdings) [https://lpl.com/](/security-report/lpl-financial-holdings) ## Latest news Stay up-to-date with the latest news in cybersecurity. * ### [Hugging Face data breach: key facts and what we know so far](/news/hugging-face-data-breach-2026-07-20) A data breach involving Hugging Face was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 20, 2026 * ### [EY data breach: what happened and what's at risk](/news/ey-data-breach-2026-07-19) A data breach involving EY was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 17, 2026 * ### [South Florida Injury & Convenient Care data breach exposes names and Social Security numbers](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) A data breach involving South Florida Injury & Convenient Care was reported in July 2026. See incident details, impact on customers, and security measures. UpGuard Team July 16, 2026 * ### [Park West Psychology data breach: what happened and what's at risk](/news/park-west-psychology-data-breach-2026-07-16) A data breach involving Park West Psychology was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 16, 2026 * ### [Fall River Municipal Credit Union data breach: what happened and what's at risk](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) A data breach involving Fall River Municipal Credit Union was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 16, 2026 * ### [NPCIL data breach: World Leaks claims exposure of Kudankulam Nuclear Power Plant files](/news/npcil-data-breach-2026-07-16) A data breach involving NPCIL was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 16, 2026 [View all news](/news) ## Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights.