LPL, Ameriprise report online attacks on clients’ accounts, data to Maine

LPL Financial and Ameriprise Financial Services recently sent letters to a small number of clients detailing attacks on their private information.

Regarding LPL, the attack resulted in so-called “pump-and-dump” trades from September 30 to October 10 in 53 clients’ accounts. In respect to Ameriprise, a financial advisor fell prey to a phishing scam in December and potentially leaving sensitive information vulnerable for 598 clients. 

Both were reported recently to Maine’s Attorney General, which publishes such incidents online. LPL reported its data breach December 26 and Ameriprise on January 2.

A number of financial advice firms over the past several years have reported similar data breaches.

Financial advisors, meanwhile, are moving to and from firms at a steady clip and are selling their practices or getting recruiting bonuses to move to new firms. Increased movement by financial advisors means firms and advisors more than ever have to pay attention to the safety of private client information, the data that cyber thieves covet.

“Such attacks are an ongoing, real concern, particularly when advisors are moving firms,” said Louis Tambaro, an industry attorney. “That could include personal email accounts that expose firms to data breaches, as well as customer privacy issues.”

“We identified unusual activity involving accounts tied to a very small number of affiliated advisors,” an LPL spokesperson wrote in an email. “The activity was promptly contained, and there are no ongoing issues relating to this matter.”

“Regarding this isolated incident, we acted swiftly to contain it and notify impacted clients,” an Ameriprise spokesperson wrote in an email. “Importantly, there was no disruption in service, and we have seen no evidence that client information was improperly used.”

“Between September 30, 2025, and October 10, 2025, we learned of unauthorized securities transactions involving accounts maintained by clients of a small number of our affiliated financial advisors,” according to LPL’s letter to clients. “We promptly contacted law enforcement and launched an investigation, with assistance from outside experts, to determine what occurred and to address the activity.”

“Based on our investigation, we believe foreign threat actors gained access to the online accounts of certain affiliated financial advisors and used them in connection with a ‘hack pump-and-dump’ trading scheme intended to artificially inflate the prices of securities,” according to LPL’s letter. “As part of this activity, and in the course of executing the scheme, we believe the threat actors may have been able to view certain of your personal information.”

“On December 4th, your advisor was the victim of a phishing incident,” according to the Ameriprise letter to clients. “The individual received an email that appeared to be a legitimate communication from a client. This incident provided a bad actor with the potential to access and/or transmit certain client information for a temporary period of time.

“While we have not identified evidence that your personal information was actually accessed or transmitted, we are providing this notice as a precautionary measure,” according to the Ameriprise letter. “Our information security team promptly detected and contained the incident. We immediately initiated a thorough investigation that allowed us to identify the clients who may have been affected and the scope of the information that could have been compromised.”