LPL Crying Foul on Data-Breach Notices Signals 'Bad Faith': Ameriprise

"At that time, the Bulk Upload Tool was alleged to contain myriad (yet largely unknown) categories of customer information taken and misappropriated by various registered representatives who resigned from Ameriprise to join LPL," the complaint states.

"This court — through a series of orders for the parties to meet and confer—ultimately required LPL to, for the first time, reveal the identities of the thirty Bulk Upload Tool users," the complaint goes on to state.

Later, LPL agreed to, among other things, the production of all Bulk Upload Tools used by 30 advisors "to abscond with extensive, sensitive customer information," according to the complaint.

Importantly, LPL also agreed "that part of the purpose behind its production of the Bulk Upload Tool was 'for the purpose of Ameriprise determining whether it must make notification to customers and what information to include in the notification to customers,'” Ameriprise points out.

LPL also agreed to the requirement that Ameriprise agrees to provide a copy of such notice to individuals who became customers of LPL, to LPL, and provide a date such notice is made if any.

"LPL feigns shock that Ameriprise sent out data breach notifications, but again ignores the fact that both LPL and this Court already knew that Ameriprise was contemplating the need to send a data breach notification in light of the Stipulated Order," the complaint states.

"If sending a breach notification letter was so improper, why did LPL expressly agree in the Stipulated Order that Ameriprise could do it? For LPL to cry foul about this now signals bad faith," Amerprise states.

Clients Get Breach Notices

LPL stated in its lawsuit that it "needs to immediately know which customers Ameriprise sent the Notice to and what Ameriprise told them about the safety and security of their data."

In its April 18 opposition filing, Ameriprise states that "all of the individuals who received the breach notice, were Ameriprise customers or beneficiaries of Ameriprise customers," and that "the sensitive personal information for these individuals that was the subject of the breach notice was sourced from Ameriprise books and records and transmitted to LPL via the Bulk Upload Tools."

Prior to LPL’s production of the Bulk Upload Tools on Jan. 24, 2025, Ameriprise states that it "did not know the specific information taken by the advisors, nor the identities of the customers for whom information was taken."

"Any complaint by LPL that a data breach notification should not have been sent is therefore not credible, as LPL and Ameriprise, and even this court, contemplated the likelihood that Ameriprise would need to send a data breach notification letter, and that this letter could be sent to individuals who became customers of LPL, based on the very legitimate concerns raised by this Court," the complaint states.

Contrary to LPL’s assertions, Ameriprise’s Notice "contains true and accurate information, is not defamatory, and was not used as a litigation strategy," the filing states.

If LPL and the relevant advisors "really believed that the advisors were authorized to take this extensive information and give it to LPL when they resigned from Ameriprise, all they had to do was provide Ameriprise with a copy of the already filled out Bulk Upload Tool and let Ameriprise know that it contained all of the client information they were taking with them," the filing contends. "But of course, that did not occur."

LPL and the advisors "in question sought to hide this misappropriation, and ultimately Ameriprise had to come to this Court to compel LPL to produce that information."

(Credits: Adobe Stock)