DisclosureLens
HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedIdentity (basic)Financial accountLowContained

Teachers Insurance and Annuity Association of America-College Retirement Equities Fund

bd_64b8aab8b357fd3f · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 6, 2025

Filed

Nov 13, 2025

To disclose

—

Affected

1state residents only

Confidence

66%

TIAA reported a cybersecurity incident involving one Maryland resident. An unauthorized individual accessed the resident's TIAA account between January 4 and January 6, 2025, using valid credentials obtained from an unknown external source. TIAA reset the credentials, placed additional authentication monitoring, and offered 24 months of complimentary credit monitoring.

Incident timeline

undetected · 2 days

Jan 4, 2025

Begins

Jan 6, 2025

Discovered

Nov 13, 2025

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.