HackingVulnerability ExploitZero-DaySupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTCVE-2023-34362MediumContained
TIAA Kaspick, LLC
bd_05f642e9efff15cc · schema v1 · pii pii-v1
Full breach record for TIAA Kaspick, LLC →TIAA Kaspick, LLC reported a data breach impacting 359 Maine residents after a vendor, Pension Benefit Information, LLC (PBI), was affected by a zero-day exploit in its MOVEit Transfer server. The breach, which occurred between May 29 and May 30, 2023, and was discovered on June 23, 2023, resulted in the acquisition of names and Social Security numbers. TIAA Kaspick is offering two years of complimentary credit monitoring and identity theft restoration services through Kroll.
Maine clockDiscovered Jun 23, 2023 → Filed with AG Jul 27, 202334d ⏱ ME AG >30d5 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_b82d3fc6babe68a1California State AGfiled 2023-07-27Verified
- bd_fa66956c081fbea7Idaho State AGfiled 2023-07-27Verified
- bd_8ae2f91c9a2c0c12New Hampshire State AGfiled 2023-07-26(1d gap)Verified
- bd_f2b549864eb15db8Montana State AGfiled 2023-07-26(1d gap)Candidate
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/5efc3621-0782-4bc6-b8f0-85685f5778fb.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 27, 2023
- Raw hash
- f93fe456e5c573d4ba51fe0d1df45522c299d7c7a5cf0b6164fa0fcfd1e85f3d
Reporting entity
- Name
- TIAA Kaspick, LLCnorm: tiaa kaspick
Victim entity
- Name
- TIAA Kaspick, LLCnorm: tiaa kaspick
Incident
- Discovered
- Jun 23, 2023
- Materiality determined
- —
- Notification sent
- Jul 14, 2023
- Affected individuals
- 359
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- CVE references
Compliance
- Time to disclose
- 5 weeks(34 days from discovery to filing)
- Compliance flags
- ME AG >30d · 34d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Jun 23, 2023→ Filed with AG: Jul 27, 202334d 30 days (soft) ME AG >30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.