FINRA Fines Units for Privacy Violation

From 2002 to 2009 at Lincoln Financial Securities and from 2007 to 2009 at Lincoln Financial Advisors, employees at the companies retrieved 1 million customer records through the shared credentials, FINRA says.

Neither Lincoln Financial Securities nor Lincoln Financial Advisors could track how many employees, or which employees, gained access to the customer record site during this period, FINRA says.

The shared credentials system put confidential customer information, including Social Security numbers and account balances, at risk, FINRA says.

Lincoln Financial Security also failed to require brokers working remotely to install security application software on personal computers used to conduct the firm’s securities business, FINRA says.

Lincoln, the parent company, says in a statement that it is committed to protecting client confidentiality.

Neither Lincoln Financial Advisors nor Lincoln Financial Security had any cause to believe that information about their clients had been acquired or misused by any unauthorized person, Lincoln says.

“Upon learning of the data vulnerabilities, each company took prompt and aggressive action to improve data security and strengthen its security policies and procedures across its information technology platforms,” Lincoln says. “In addition, as a precaution, the companies voluntarily notified potentially affected former and current clients about the data vulnerability and offered them up to one year of continuous credit monitoring and, if necessary, identity theft consultation and restoration services, at no cost.”