MisusePrivilege AbuseSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTAUTHENTICATIONMediumContained
United Services Automobile Association
bd_0c70b2c5273f01e8 · schema v1 · pii pii-v1
Full breach record for United Services Automobile Association →USAA notified Vermont consumers of a data incident where unauthorized individuals accessed member information via stolen credentials from a third-party call center provider. The incident occurred between Dec 2022 and May 2023. Affected data included names, addresses, DOB, driver's license numbers, partial SSNs, bank account numbers, and PINs. USAA blocked access, is monitoring accounts, and offered two years of Experian IdentityWorks.
Vermont clock⏱ VT AG >14 bday5 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://ago.vermont.gov/document/2023-06-22-usaa-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 22, 2023
- Raw hash
- 2c0bcc2a3e2d59cd2dc3bfe655fb2b2169012dd3dbbf4046dbcb11c987dcd479
Reporting entity
- Name
- United Services Automobile Associationnorm: united services automobile
Victim entity
- Name
- United Services Automobile Associationnorm: united services automobile
Incident
- Discovered
- May 18, 2023
- Materiality determined
- —
- Notification sent
- Jun 22, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTAUTHENTICATION
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Third party
- via third-party service provider
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 5 weeks(35 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.