MisuseFinancial ServicesFinancePrivilege AbuseEmployee Data InvolvedTargetedIdentity (basic)Government IDFinancial accountCredentialsMediumContained

TIAA, FSB

bd_0ea097812632083a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 13, 2022

Filed

Feb 21, 2023

To disclose

10 weeks

Affected

7state residents only

Linked

8 filings

Confidence

67%

Full breach record for TIAA, FSB →3 incidents on file

TIAA, FSB notified the Idaho AG of a security incident on Dec 13, 2022, involving a former employee with access to personal information. 7 Idaho residents were potentially impacted. Data included names, SSNs, financial account info, and credentials. TIAA engaged law enforcement and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 weeks / 70 days

Dec 13, 2022

Discovered

Feb 21, 2023

Filed

vs. sector median

+2 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Maine State AGbd_3a438ba5fafcf9422023-02-21Verified
Montana State AGbd_a6f620f9ca86fdff2023-02-21Verified
Massachusetts State AGbd_a8ea315a3b47e4ea2023-02-21Verified
Washington State AGbd_c1cf35d41dacca652023-02-21Verified

Show 3 more filings ↓up to 48d gap

Indiana State AGbd_264806535d03c2b22023-02-22 · +1dVerified
Massachusetts State AGbd_33c5719e50d893662023-02-15 · +6dVerified
Massachusetts State AGbd_d9d85c728eeb4c002023-04-10 · +48dCandidate

Name: TIAA, FSB
norm: tiaa fsb
Domain: tiaabank.com

Name: TIAA, FSB
norm: tiaa fsb
Domain: tiaabank.com
Industry: Financial Servicesllm

Discovered: Dec 13, 2022
Materiality determined: —
Notification sent: Feb 22, 2023
Affected individuals: 7state-resident count only
Data types: Identity (basic)Government IDFinancial accountCredentials
Data elements: Social Security numberDate of birth
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: Notified Idaho Office of the Attorney GeneralLaw enforcement requested a delay in notification
Initial access: insider_action

During the incident: Engaged law enforcement
Implemented incident response protocols
Implementing additional controls and training
Offering customer notification, ID theft protection, and credit monitoring
Changes made: Implementing additional controls and training
Implementing coaching
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(70 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 6 states

View merged incident ↗

Massachusetts State AGFeb 15 · first

Maine State AG+6d

Montana State AG+6d

Massachusetts State AG+6d

Washington State AG+6d

Idaho State AG+6d · this page

Indiana State AG+7d

Massachusetts State AG+54d

Pattern: first filing Feb 15 (MA), last Apr 10 (MA) — a 54-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.ag.idaho.gov/content/uploads/2023/03/TIAA-Bank-2-21-2023.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 21, 2023
Raw hash: 81b69f29487d433915fbe97f14cdebcd1bb3bd29b1c8bbf4f981fca111ce0851

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityTIAA, FSB

Victim entityTIAA, FSB

Incidentdiscovered Dec 13, 2022

Stated responseEngaged law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.ag.idaho.gov