Loading story…
JPMorgan filed a federal complaint seeking a temporary restraining order and injunctive relief against former advisor Kevin J. Sercia, alleging he stole confidential client information and trade secrets to solicit clients after moving to an affiliate of LPL Financial. The complaint alleges “highly suspicious computer access” shortly before his resignation, including after-hours access to roughly 175 client profiles in JPMorgan’s Advisor Central system, many viewed in rapid succession.
Separately, the FBI alleged that a government contractor employee with elevated access to classified systems, Perez-Lugones, improperly accessed and removed classified information, including taking screenshots of a classified intelligence report, embedding them in a Word document, and printing them under innocuous filenames. Search warrants executed on his home and vehicle reportedly recovered documents marked SECRET, including one found in a lunchbox in his car, and investigators alleged he removed classification markings before leaving his workplace; the case also involved seizure of a Washington Post reporter’s devices as part of a leak investigation.
See attribution, scope, and your downstream exposure.
7 events from the most recent confirmed update back to the earliest known activity.
JPMorgan filed a federal lawsuit in the Southern District of Florida seeking a temporary restraining order and injunctive relief against former advisor Kevin J. Sercia, alleging he stole confidential information to solicit clients for LPL Financial.
JPMorgan alleges Kevin J. Sercia conducted suspicious after-hours access to internal systems shortly before resigning, including rapidly viewing about 175 client profiles in Advisor Central in the hours before his departure.
Following the investigation, Perez-Lugones was charged under a U.S. law carrying penalties of up to 10 years for allegedly removing and mishandling classified information. A magistrate judge approved release, and the U.S. government sought review of that decision.
On 2026-01-08, search warrants were executed at Perez-Lugones's home in Laurel, Maryland, and his vehicle. Investigators reportedly found documents marked SECRET, including one in a lunchbox in his car and another in his basement.
Investigators allege Perez-Lugones was seen taking handwritten notes from a classified-system workstation, adding to evidence that he was removing sensitive information from secure environments.
The FBI affidavit says Perez-Lugones accessed an additional classified intelligence report on 2026-01-05 as part of the alleged improper removal of classified information from secure systems.
According to an FBI affidavit, Perez-Lugones accessed a classified intelligence report and on 2025-10-28 allegedly took screenshots, inserted them into a Microsoft Word document, and printed the material in a way meant to appear innocuous in print logs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourcearstechnica.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
JPMorgan Chase disclosed that attackers breached its network and accessed customer contact information tied to **76 million households** and **7 million small businesses**, making it one of the largest publicly reported compromises of a U.S. financial institution. The bank said the stolen data included names, email addresses, phone numbers, and physical addresses, while **account numbers, passwords, Social Security numbers, dates of birth, and debit or credit card data were not exposed**. The intrusion reportedly began in June, went undetected for weeks, and involved access to more than 90 servers before the company contained it and notified customers using services such as Chase.com and its mobile banking platforms. U.S. investigators examined possible Russian links early in the case, and later authorities charged **Gery Shalon, Joshua Samuel Aaron, and Ziv Orenstein** in connection with a broader hacking campaign tied to the JPMorgan intrusion and other attacks on financial firms and publishers. Prosecutors described the operation as part of a multi-year scheme that stole data from more than 100 million customers across victims, while security experts warned that the JPMorgan data set remained highly valuable for phishing and fraud because it provided a large, current list of bank customers and small businesses. JPMorgan said it had not seen unusual fraud directly tied to the breach and urged customers to be wary of unsolicited emails and text messages.
Jun 29, 2026
Anonymous-affiliated attackers breached private intelligence firm **Stratfor**, stealing subscriber records, payment data, and a vast archive of internal correspondence. Reporting on the intrusion said the attackers accessed administrative systems, expanded into databases and mail servers, and exfiltrated data affecting about **860,000 user accounts** and more than **60,000 credit cards**; some reports said card numbers were stored in plaintext, while passwords were protected with weak **unsalted MD5** hashes. The attackers defaced Stratfor’s website, deleted server contents, published stolen card data, and used some of the payment information for fraudulent charitable donations, contributing to losses that reports put at at least **$700,000** and broader damages of roughly **$2 million**. The breach escalated when **WikiLeaks** began publishing roughly **5 million Stratfor emails**, exposing the firm’s client relationships, source-handling practices, monitoring of activist groups, and sensitive geopolitical claims contained in internal messages. Subsequent reporting said the FBI had visibility into parts of the operation through informant **Hector Xavier Monsegur ("Sabu")** and later built its case against alleged participant **Jeremy Hammond**, while Stratfor faced delayed customer notification and legal fallout. Years later, researchers also warned that some documents in the leaked Stratfor archive contained live malware, including files exploiting **`CVE-2010-3333`**, creating additional risk for journalists and researchers who downloaded the material.
Jun 29, 2026
DocketWise, a case management platform used by U.S. immigration attorneys, disclosed a breach affecting **116,666 individuals** after threat actors gained unauthorized access to credentials for a third-party partner instance and used valid credentials to clone repositories in a data migration pipeline containing unstructured customer data. The exposed information varied by person but may have included **Social Security numbers, tax IDs, passport and driver’s license numbers, dates of birth, financial and payment data, medical information, health insurance details, and account credentials**. DocketWise told Maine regulators it had no evidence the incident specifically targeted immigration firms or that the data had been publicly released. The breach affected clients of five named law firms and added to concerns over data handling in the immigration legal sector. Separate reporting also highlighted a recent exposure involving a **misconfigured Amazon bucket** tied to Dalbir Singh and Associates, PC in New York City, which reportedly left about **111,000 immigration-related files** accessible until it was secured after repeated outreach. Together, the incidents exposed highly sensitive records belonging to immigration law firms and their clients.
Jun 29, 2026