LPL Financial is offering identity protection services and credit monitoring following a data breach that revealed the Social Security numbers, names, addresses and account numbers of financial advisors and their clients, according to InvestmentNews.
Third-Party Data Breaches and What to Do About Them
On November 1st, Capital Forensics found that a third-party file-sharing system they use had been accessed by an unauthorized individual, the publication writes. The files of several of Capital Forensics’ clients were exposed, including LPL’s, InvestmentNews writes.
All LPL data was promptly removed and the regulators were notified, Dan Arnold, LPL president and CEO, wrote, according to the publication. Capital Forensics announced that the attack was mitigated in 6 hours and lasted no more than 4, and that they are now working with experts to investigate and have established a call center for affected investors, according to InvestmentNews.
LPL spokesman Jeff Mochal said the breach is still under investigation but they have informed their financial advisors and will contact affected investors with further information soon, the publication writes. Arnold told brokers in an email that impacted accounts will have increased monitoring, although the number of investors and advisers affected has not yet been released as of November 14, according to InvestmentNews.
Similar to the recent breach at Voya Financial Advisers, which led to a $1 million settlement with the Securities and Exchange Commission, LPL’s data breach highlights the possibility of third parties creating vulnerabilities, the publication writes.
It is hard to know if LPL or Capital Forensics are open to enforcement action without specifics on the breach, Harley Lippman, CEO of Genesis10, tells InvestmentNews. But firms such as LPL need to improve their penetration testing to find weaknesses in third-party systems, as not every company does, Lippman tells the publication.
