Skip to content
Breach Index · running record

BlackRock data breach history (2016-2026): the 2019 iShares adviser data leak and nothing confirmed since

BlackRock is the world’s largest asset manager and runs the Aladdin platform many other firms use. This page records its security incidents since 2016, what BlackRock said, and what advisers and investors should take from it.

Short answer

Was BlackRock hacked?

We found no confirmed breach of BlackRock’s own systems from 2016 to 2026 in the sources we read. The one public data exposure was an error, not an attack.

In January 2019 BlackRock “inadvertently posted a small number of sales-related documents” on its iShares website, Bloomberg reported. The spreadsheets held names, email addresses and other details of about 20,000 US financial advisers who work with iShares, about 12,000 of them at LPL Financial, including internal tier labels such as “club level”. BlackRock said: “There was no security breach and no compromise of BlackRock systems,” and that no information about advisers’ end clients was included.

We found no BlackRock entry in California’s breach list, and our searches found no vendor-breach notice or leak-site or forum claim naming BlackRock in the period.

Timeline at a glance

  1. 18 Jan 2019Bloomberg reports sales spreadsheets with adviser data posted on the iShares site. (Bloomberg)Confirmed
  2. 21 Jan 2019BlackRock: human error, “no security breach and no compromise of BlackRock systems”. (Bloomberg / Wealth Management)Confirmed
  3. 2016-2026No BlackRock entry in California’s breach list; no vendor or leak-site claims found. (California AG)Not a breach

Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

BlackRock incident timeline, in detail

Confirmed = acknowledged by BlackRock, a regulator filing or a court. Reported = credible reporting BlackRock has not fully confirmed. Unverified claim = an attacker or leak-site claim.

Jan 2019ConfirmedAccidental exposure (website error)

iShares website exposes details of about 20,000 advisers

What happened. BlackRock posted sales-related spreadsheets on its iShares website, where they were public for a period before removal, according to Bloomberg. IT Pro reported the data may have been available for more than a month. BlackRock called it human error and said there was no compromise of its systems.

Impact. Names, email addresses and other details, including sales tier labels, of about 20,000 independent advisers, about 12,000 at LPL Financial. No information about advisers’ end clients, per BlackRock. LPL notified its advisers.

Sources: Bloomberg via Wealth Management, 22 Jan 2019 · Bloomberg, 21 Jan 2019 · IT Pro, 21 Jan 2019

Where the reports disagree

  • Exposure window: BlackRock said the documents were up “for a short period of time”; IT Pro’s standfirst says they could have been available for more than a month.

The pattern across the record

Publishing errors, not intrusions

The only public BlackRock data exposure in ten years was a website publishing mistake. Content review before upload would have caught it.

Adviser lists are phishing fuel

Names, emails and sales tiers tell a phisher who matters to a fund manager and how to address them. That is why the 2019 leak mattered even without client data.

What it means for BlackRock advisers and investors — and what to do

There is no confirmed BlackRock breach for investors to act on. Advisers whose details were in the 2019 spreadsheets should expect convincing phishing that uses their name and firm.

  1. 1.Verify any “BlackRock” or “iShares” request

    Call back on a number you already have before acting on emails asking you to log in or update details.

  2. 2.Protect your own logins

    Use phishing-resistant sign-in on adviser portals and email.

    Phishing-resistant MFA planner
  3. 3.Check any letter you receive

    If a breach letter names BlackRock, check who sent it and which vendor was involved.

    Decode a breach notice

CISO takeaways

Rehearse a data exposure you caused

An accidental publication still needs scoping, notification decisions and partner communication.

Customer database breach lab
Map the notification clocks

Even a “no breach” exposure can trigger state notice duties if personal data was public.

Notification clock calculator

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed November 13, 2026.

  1. 1.BlackRock’s data leak strikes 20,000 advisers, mostly at LPL — Bloomberg (via Wealth Management), 22 Jan 2019
  2. 2.BlackRock’s data leak strikes 20,000 advisers, mostly at LPL — Bloomberg, 21 Jan 2019
  3. 3.BlackRock leaks personal data of thousands of clients — IT Pro, 21 Jan 2019
  4. 4.Data security breach search: BlackRock (no entries) — California AG, 13 Nov 2026

Frequently asked questions

Was BlackRock hacked?

We found no confirmed breach of BlackRock’s own systems from 2016 to 2026. In 2019 BlackRock accidentally posted adviser data on its iShares website, which it called human error.

What was the BlackRock data leak?

In January 2019 sales spreadsheets on the iShares website exposed names, email addresses and other details of about 20,000 US financial advisers, about 12,000 of them at LPL Financial. BlackRock said no end-client data was included.

Has BlackRock had a data breach in 2025 or 2026?

We found none as of 13 November 2026: no entry in California’s breach list, and no vendor-breach notice or leak-site claim naming BlackRock in our searches.

Is there a BlackRock data breach settlement?

We found no data breach lawsuit or settlement involving BlackRock.

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Coinbase data breachFinancial services

Bribed support agents, 69,461 customers, an 8-K.

TransUnion data breachFinancial services

4.4M people via a third-party support app (2025).

Apollo Global Management data breachFinancial services

Social engineering and cloud platforms.

Invesco data breachFinancial services

No confirmed breach; 2024 vendor ransomware in Japan

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by BlackRock. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.