LPL, Ameriprise once again report attacks on client data to Maine

For the second time in the past few months, LPL Financial and Ameriprise Financial have been flagged by the state of Maine for client information snafus.

The office of the Maine attorney general reported this week that LPL Financial, with more than 32,000 financial advisors, reported a data breach from November while Ameriprise, with more than 10,000 financial advisors, last week reported an incident from March.

According to the Maine attorney general’s website, 1,581 LPL clients were affected in a phishing scam that occurred November 10 and was discovered 10 days later. LPL Financial previously reported to Maine a client data attack on breach at the end of December.

At Ameriprise, 47,876 clients were affected by the data breach that happened March 2 and was discovered 16 days later. Ameriprise Financial at the start of the year reported that a financial advisor fell prey to a fishing scam in November.

A number of financial advice firms over the past several years have reported similar data breaches. The office of Maine’s attorney general publishes such incidents online. 

LPL Financial’s clients were targets of a malware and phishing scam, according to a letter to clients from the company.

“Between November 20, 2025, and November 25, 2025, we learned of unauthorized securities transactions and financial transfers involving accounts maintained by clients of a small number of our affiliated financial advisors,” according to the letter. “We promptly contacted law enforcement and launched an investigation, with assistance from outside experts, to determine what occurred and to address the activity.”

“Our investigation found that malware distributed through phishing messages affected a limited number of individual advisor devices and resulted in unauthorized third-party access to the accounts of those advisors on LPL’s web-based advisor portal,” according to the letter. “Our investigation did not identify evidence that your sensitive personal information was accessed or acquired by a third party in connection with these events.”

The attack at Ameriprise focused on client data and files, according to a letter to clients.

“An unauthorized individual gained access to certain Ameriprise stored data and files, which may have included your personal information, and which we blocked upon discovery on March 18, 2026,” according to the letter. “We immediately launched an investigation with the help of external cybersecurity experts.”

“We want to reassure you that no unauthorized transactions or movement of funds occurred as part of this incident,” according to the letter. “The affected information varied from person to person.”

An LPL Financial spokesperson did not return a phone call Friday afternoon to comment.

An Ameriprise spokesperson said: “This relates to a recent incident that involved unauthorized access to certain stored data and files.”

“Importantly, there was no disruption to business operations,” the spokesperson added. “We are taking appropriate actions, including notifying the limited number of individuals with personally identifiable information or PII impacts and offering them credit and identity monitoring.”