BlackRock's Data Leak Strikes 20,000 Advisers

(Bloomberg) -- A data leak revealed last week at BlackRock Inc. exposed names, email addresses and other information of about 20,000 advisers who are clients of the asset manager, including 12,000 at LPL Financial, the largest U.S. independent broker dealer.

“BlackRock inadvertently posted a small number of sales-related documents, which were up for a short period of time, and promptly removed,” the company said Monday in an emailed statement. “The information related to a very limited number of wealth management platforms impacting approximately 20,000 independent advisers in the U.S.”

LPL informed advisers over the weekend that BlackRock posted details about some of them on its website. The leak affected advisers who do business with BlackRock’s iShares exchange-traded funds unit.

“After being informed by BlackRock of this issue, our first priority was to reach out to our advisers to make them aware of the situation and share the details we had learned,” Jeffrey Mochal, a spokesman for LPL, said Sunday in a statement. “We will continue to stay in close communication with BlackRock as they research the incident and will share information with our advisers as it becomes available.”

ETF Business

BlackRock and LPL are the latest financial firms to be ensnared in a data issue affecting a key part of their business. ETF sales are crucial to BlackRock, which runs the world’s largest ETF business. Such products account for one-third of the approximately $6 trillion in assets BlackRock oversees. Registered financial advisers who work with brokerages such as LPL are a key channel for getting ETFs into individual investor portfolios.

BlackRock didn’t identify the other platforms affected. The company said it “recognizes the seriousness of the error and we deeply regret that it occurred. We always seek to treat the information entrusted to us with great care.”

Bloomberg News reported on Friday that BlackRock accidentally released information on thousands of financial advisers on its website. The data appeared in several spreadsheets, some of which included designations such as "club level." LPL categorizes advisers with such tiers, including a so-called "Chairman’s Club" for some top performers.

In its statement, BlackRock said the disclosures resulted from human error. “There was no security breach and no compromise of BlackRock systems,” the firm said. Sales-related information for an internal customer relationship management-related system was inadvertently posted on iShares.com, the company said.  

‘Limited Scope’

BlackRock said it notified affected firms about the leak, and that after performing reviews of its website, the company is confident it understands the “limited scope and implications” of the issue. “The sales related documents did not relate to any other client businesses at BlackRock,” according to the statement.

“No information about financial advisers’ end clients was included,” BlackRock said. “And no sensitive personal or financial information about advisers or anyone else was included. Additionally, there were no ticker- or portfolio-level holdings information disclosed.”

LPL serves more than 16,000 financial advisers with functions including trading and compliance. In a separate incident in November, LPL said that it was investigating a data breach at a vendor firm, Capital Forensics Inc., that put investors’ personal information at risk.

Capital Forensics confirmed at the time that the attack exposed data from a “small number” of its clients.

Keeping information secure is an increasingly important issue at financial firms, forcing them to brace against both cyber attacks and human error.

Data Losses

“Inadvertent exposure and loss of data is more common than we think,” Rahul Telang, a professor of information systems and management at Carnegie Mellon University, said in an interview. “A lot of time the firms spend a lot of money trying to protect data from hackers but small errors on the part of a human can have the same effect.”

Karen Barr, president and chief executive officer of the Investment Adviser Association, said any advisers concerned their information may have been disclosed should start by taking stock of what was released.

“The first step is to assess the depth and type of the information” that was available, she said. “You really put your arms around the issue and the extent of the potential damage.”

To contact the reporter on this story: Annie Massa in New York at amassa12@bloomberg.net

To contact the editors responsible for this story: Margaret Collins at mcollins45@bloomberg.net, ;Alan Goldstein at agoldstein5@bloomberg.net, Alan Mirabella, Steve Dickson

©2019 Bloomberg L.P.