Trust Center
Welcome to Broadridge's Trust Center. Our commitment to data privacy and security is embedded in every part of our business. Use this Trust Center to learn about our security posture and request access to our security documentation.
The goal of the Broadridge Information Security Group (BISG) is to provide guidance to all Broadridge associates and contingent workers on Information Security standards, polices, and procedures so that they can incorporate security into their job functions
The mission of the BISG is to provide the guidance and practical solutions to support the business to ensure the confidentiality, integrity, and availability of Broadridge’s information assets through the implementation and management of the Information Security Management Program. This includes guidance for the collection, use, maintenance, security, and disclosure practices of personal information by Broadridge and its subsidiaries as outlined in the BR Global Privacy Policy. This involves the creation, administration, and communication of policies and
standards to ensure the correct protection mechanisms are in place to support the mission.
The purpose of the Information Security Management Program is to ensure that management is appropriately advised and supported so that Broadridge can effectively implement security controls that enable Broadridge to meet the requirements of Internal Audit, external auditors, applicable regulations, clients, and other parties that trust Broadridge to safeguard their information.
The charter of the BISG is to:
• Identify/assess operational and application risks/vulnerabilities and propose recommendations for mitigation through the utilization of appropriate information security controls. (Risk Assessment)
• Protect against any anticipated threats and hazards of information resources (Security Incidents).
• Establish controls to prevent loss or compromise of information resources. (Data Loss Prevention)
• Promote information security awareness within the organization. (Training and Awareness)
• Establish core competencies of Information Security within the business. (Standardization)
• Provide guidance on user and system access to ensure appropriateness for
business functions (Entitlements Management)
• Establish control frameworks (ex. ISO, HIPAA, PCI, NIST, SSAE-18) gather
evidence, and report to management the state of information security within the business. (Risk & Compliance)
• Govern the processes to ensure the proper disposal of company and client
information
Trust Center Updates
Emerging AI-driven cybersecurity risks
Broadridge actively monitors emerging AI-driven cybersecurity risks and evaluates their potential impact through our existing enterprise cybersecurity, software security, and risk management programs. With respect to developments such as Anthropic’s Mythos model and Project Glasswing, we are assessing the broader implications of AI-enabled vulnerability discovery and exploitation as part of our ongoing threat monitoring and control evaluation processes.
-
Assessment and response to emerging AI-driven security risks
Broadridge is addressing emerging AI-related risks through established governance and security processes, including threat intelligence review, vulnerability management, secure development practices, and third-party risk oversight. We see how AI increases the speed or scale of vulnerability discovery, exploitation attempts, phishing, or other malicious activity, and we have been enhancing our controls to address those risks effectively. -
Current and planned controls
Broadridge maintains layered security controls designed to protect our environment, including secure development practices, vulnerability scanning, patch management, penetration testing, monitoring and detection capabilities, access controls, incident response procedures, and third-party risk management. We are also adopting control enhancements, as appropriate, in areas such as AI governance, monitoring for anomalous activity, secure use of AI-enabled tools, and software supply chain risk management. -
Timeframe for enhanced measures
Our approach is ongoing and risk-based. Many relevant controls are already in place today, including AI based security monitoring, automated controls for remediation and any additional enhancements are being evaluated and implemented through our normal cybersecurity and change management processes based on risk priority. -
Vulnerability identification, management, and disclosure
Broadridge maintains processes to identify, assess, prioritize, remediate, and track vulnerabilities using a combination of scanning, testing, threat intelligence, and internal review. Where a vulnerability or security issue materially affects client data, services, or the Broadridge environment supporting our clients, notification would be made in accordance with applicable contractual obligations and established incident response procedures.
Thank you, Broadridge.
React2Shell remote code execution flaw, CVE-2025-55182 and CVE-2025-66478
Broadridge Threat Response December 10th, 2025
On December 3rd, Broadridge was informed of a critical vulnerability, React2Shell remote code execution flaw, CVE-2025-55182 and CVE-2025-66478. More details over the React2Shell vulnerability can be viewed at: NVD - CVE-2025-55182 and NVD - CVE-2025-66478
Broadridge has examined our perimeter systems, applied patches/mitigation as needed, and current scans have found no trace of the React2Shell vulnerability. Broadridge is continuously monitoring our environments to ensure our clients, customers, stakeholders, and associates remain unaffected.
Threat Actors Targeting Vulnerable F5 Devices.
Threat Response October 17, 2025
BROADRIDGE RESPONSE STATEMENT
On October 15th, 2025, Broadridge was notified about a recent announcement regarding an F5 data breach where hackers stole source code and other data. The company revealed that a sophisticated nation-state threat actor had gained long- term access to internal systems, exfiltrating sensitive files including BIG-IP source code and details on undisclosed vulnerabilities.
F5’s investigation found no signs of compromise in its software supply chain, including build systems or released code. However, the breach may impact some customers. A limited portion of the stolen files from its knowledge platform contained configuration information related to specific BIG-IP deployments.
To protect users, F5 issued critical patches in its October 2025 Quarterly Security Notification. These updates cover BIG-IP, F5OS, BIG-IP Next for Kubernetes, BIG-IQ, and APM clients. Customers are strongly encouraged to install the patches immediately, even though no active exploitation has been detected.
In response to the F5 data breach, Broadridge has investigated and identified 15 internet-facing devices, which were immediately acted upon by implementing a remediation plan, which will result in all 15 devices addressed in accordance with patch guidance instructed by F5, by October 19th. Broadridge is continuously monitoring our environments to ensure our clients, customers, stakeholders, and associates remain unaffected.
Please see the following resources for more information:
CISA Emergency Directive: https://www.cisa.gov/news-events/directives/ed-26-01-mitigate-vulnerabilities-f5-devices
f5 Security Incident Details: https://my.f5.com/manage/s/article/K000154696
F5 Security Advisory: https://my.f5.com/manage/s/article/K000156572
Thank you, Broadridge
RedHat Consulting's Gitlab Environment
Threat Response October 14, 2025
BROADRIDGE RESPONSE STATEMENT
On October 8, 2025, Broadridge was notified of public reports concerning a potential breach involving Red Hat Consulting’s GitLab environment, as referenced by multiple cybersecurity sources.
In response to this reported Red Hat Consulting GitLab incident (no CVE assigned, as this represents a third-party exposure rather than a product vulnerability), Broadridge reviewed potential links and determined:
• The investigation found no evidence of Broadridge data exposure and confirmed that the referenced Red Hat Consulting “Customer Engagement Report (CER)” did not contain client data, authentication tokens, credentials, or internal system details.
• There is no indication of impact to Broadridge systems, data, or client environments.
Thankyou,
Broadridge
CISCO Advisory CVE-2025-20333, CVE-2025-20362, CVE-2025-20363
Threat Response September 29, 2025
BROADRIDGE RESPONSE STATEMENT
On September 25th, 2025, Broadridge was notified about a recent announcement from our vendor Cisco about important updates regarding the connectivity solution used to connect to the Broadridge Global Framework and Webconnect.
All Broadridge assets were verified to be patched and Broadridge is not impacted by Cisco Advisory: CVE-2025-20333: Cisco ASA and FTD WebVPN Vulnerability (CVE details), Cisco Advisory: CVE-2025-20362: Cisco ASA and FTD WebVPN Vulnerability Update , or CVE-2025-20363 cisco-sa-http-code-exec-WmfP3h3O ; however, we are continuously monitoring our environments to ensure our clients, customers, stakeholders, and associates remain unaffected.
Thank you, Broadridge