MisuseFinancial ServicesFinancePrivilege AbuseCustomer Data InvolvedIdentity (basic)Financial accountMediumContained

TIAA, FSB

bd_3a438ba5fafcf942 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Feb 21, 2023

To disclose

—

Affected · nationwide

2,58019 in this filing

Linked

8 filings

Confidence

66%

Full breach record for TIAA, FSB →3 incidents on file

TIAA, FSB reported an insider wrongdoing incident on December 13, 2022, affecting 2,580 individuals, including 19 Maine residents. The breach involved the acquisition of names and financial account or credit/debit card numbers (with security codes/PINs). TIAA notified consumers in writing and provided 24 months of credit monitoring through Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Incident timeline

Dec 13, 2022

Begins

Feb 21, 2023

Filed

This filing is one of 8 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Idaho State AGbd_0ea097812632083a2023-02-21Candidate
Montana State AGbd_a6f620f9ca86fdff2023-02-21Verified
Massachusetts State AGbd_a8ea315a3b47e4ea2023-02-21Verified
Washington State AGbd_c1cf35d41dacca652023-02-21Verified

Show 3 more filings ↓up to 48d gap

Indiana State AGbd_264806535d03c2b22023-02-22 · +1dVerified
Massachusetts State AGbd_33c5719e50d893662023-02-15 · +6dVerified
Massachusetts State AGbd_d9d85c728eeb4c002023-04-10 · +48dCandidate

Name: TIAA, FSB
norm: tiaa fsb
Domain: tiaabank.com

Name: TIAA, FSB
norm: tiaa fsb
Domain: tiaabank.com
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Dec 13, 2022
Materiality determined: —
Notification sent: —
Affected individuals: 2,580state + nationwide
Data types: Identity (basic)Financial account
Data elements: Financial account number
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: Filed data breach notice with Maine Attorney General
Initial access: insider_action

During the incident: Sent written notification to affected consumers
Offered 24 months of Experian IdentityWorks credit monitoring and identity restoration services
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 6 states

View merged incident ↗

Massachusetts State AGFeb 15 · first

Idaho State AG+6d

Montana State AG+6d

Massachusetts State AG+6d

Washington State AG+6d

Maine State AG+6d · this page

Indiana State AG+7d

Massachusetts State AG+54d

Pattern: first filing Feb 15 (MA), last Apr 10 (MA) — a 54-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/07f9fb88-e5fe-474a-bf47-f6d0b5945601.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 21, 2023
Raw hash: d1f0e9863ada6893c25c4c4da1c77bc4a19389ce98774a7b29ed75ddb59850c7

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityTIAA, FSB

Victim entityTIAA, FSB

IncidentInsider

Stated responseSent written notification to affected consumers

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov