AccidentalMisconfigurationCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
TRANSAMERICA RETIREMENT SOLUTIONS, LLC
bd_3a21b8d2b7af58cc · schema v1 · pii pii-v1
Full breach record for TRANSAMERICA RETIREMENT SOLUTIONS, LLC →Transamerica Retirement Solutions, LLC notified the New Hampshire Attorney General of a security incident affecting 20 NH residents. On June 4, 2021, a misconfiguration on a plan administration website inadvertently allowed authorized employers to view other employers' employees' data (names, SSNs, DOB, financial details) via valid credentials. The error was corrected on June 14, 2021, and notifications were sent on August 4, 2021. No misuse was found.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_258d5a7020744db7Maine State AGfiled 2021-08-04(1d gap)Candidate
- bd_6883d3537d3cd53dCalifornia State AGfiled 2021-08-04(1d gap)Verified
- bd_d7f7594b68d7ecdbMontana State AGfiled 2021-08-04(1d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/tmp-architecture-20210805.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 5, 2021
- Raw hash
- e6c9a2630b9534b1caab5a72de1fbfe0f4d2456fd095b0b33816659c2c4fd7e7
Reporting entity
- Name
- Alston & Bird LLPnorm: alston bird
Victim entity
- Name
- TRANSAMERICA RETIREMENT SOLUTIONS, LLCnorm: transamerica retirement
- Domain
- transamerica.com
- Industry
- financial_services
Incident
- Discovered
- Jun 14, 2021
- Materiality determined
- —
- Notification sent
- Aug 4, 2021
- Affected individuals
- 20
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Misconfiguration
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Regulator citations
- Notified New Hampshire Attorney General's Office
Compliance
- Time to disclose
- 7 weeks(52 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.