LPL Claims Hackers Accessed Client Accounts Through Advisors’ Devices LPL reports that malware from phishing led to unauthorized transactions in client accounts. LPL Financial is the latest firm to reveal a cybersecurity incident. According to a notice submitted to Maine’s Attorney General, the breach led to “unauthorized securities transactions and financial transfers” in some clients’ accounts. According to the data breach notification information on the attorney general’s site, LPL notified affected consumers regarding the breach that occurred on November 10, 2025 and was discovered 10 days later. A sample letter to clients provides details on the breach that affected clients working with “a small number” of the firm’s affiliated financial advisors. (LPL reported that 1,581 total clients were affected, and only two in Maine.) “Our investigation found that malware distributed through phishing messages affected a limited number of individual advisor devices and resulted in unauthorized third-party access to the accounts of those advisors on LPL’s web-based advisor portal,” the sample letter read. LPL stated in the letter that it contacted law enforcement after discovering the breach and conducted an internal investigation. While the firm didn’t identify specific evidence that “sensitive personal information was accessed or acquired by a third party,” it couldn’t rule out the possibility that third parties may have seen some clients’ information during the breach. When LPL found that breach, it stopped the activity, secured the affected accounts, and restored “any impacted accounts to their original financial positions.” The firm also implemented new “technical safeguards” to bolster its existing security and found no evidence that its systems remained compromised. The firm offered affected clients a complimentary two-year Experian credit monitoring membership. According to an LPL spokesperson, the firm "identified unusual activity involving accounts associated with a very small number of affiliated advisors. The activity was promptly contained,