HackingVulnerability ExploitData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Tiaa-cref Life Insurance Company
bd_159519eb728b514e · schema v1 · pii pii-v1
Full breach record for Tiaa-cref Life Insurance Company →TIAA-CREF Life Insurance Company notified the Idaho Attorney General of a data security incident involving its third-party vendor, Pension Benefit Information, LLC (PBI). PBI's MOVEit Transfer server was exploited between May 29-30, 2023, leading to the exfiltration of files containing names, SSNs, dates of birth, addresses, and gender of 162 Idaho residents. TIAA and PBI investigated, identified affected individuals, and provided 2 years of free credit monitoring and identity theft restoration services.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_5876c4c2a15a0cb7California State AGfiled 2023-08-01Verified
- bd_c409725c75cde49bMontana State AGfiled 2023-08-02(1d gap)Verified
- bd_e470d727916117afWashington State AGfiled 2023-08-02(1d gap)Verified
Source provenance
- Source URL
- https://www.ag.idaho.gov/content/uploads/2023/08/8-1-2023-TIAA-CREF-Life-Insurance-Company.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 1, 2023
- Raw hash
- f719277b1586211011b3c30309b77837335aa8dd4986c6ebac671f0031a1280c
Reporting entity
- Name
- Tiaa-cref Life Insurance Companynorm: tiaa cref life insurance
Victim entity
- Name
- Tiaa-cref Life Insurance Companynorm: tiaa cref life insurance
Incident
- Discovered
- Jun 9, 2023
- Materiality determined
- —
- Notification sent
- Jul 28, 2023
- Affected individuals
- 162
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified Idaho Attorney General's Office Consumer Protection Division
- Third party
- via Pension Benefit Information, LLC
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 8 weeks(53 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.