HackingVulnerability ExploitCapture Stored DataSupply Chain (3P Vendor)Data ExfiltratedTargetedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Teachers Insurance and Annuity Association of America ("TIAA")
bd_69cfd607fb6c4807 · schema v1 · pii pii-v1
Full breach record for Teachers Insurance and Annuity Association of America ("TIAA") →Pension Benefit Information, LLC (PBI) notified TIAA customers of a data breach involving the MOVEit Transfer software vulnerability exploited in May 2023. PBI confirmed unauthorized access to a server on May 29-30, 2023, resulting in the exfiltration of names, SSNs, DOBs, addresses, and gender. PBI patched systems, offered 24 months of Kroll identity monitoring, and enhanced security policies.
This filing is one of 9 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (8) · sorted by filing gap
- bd_2ebc416a4ea0530dWashington State AGfiled 2023-07-27Verified
- bd_a760fbad056957c0Maine State AGfiled 2023-07-24(3d gap)Verified
- bd_dc7396da17f400f6California State AGfiled 2023-07-24(3d gap)Candidate
- bd_7b3aede4e2719215California State AGfiled 2023-07-21(6d gap)Candidate
Show 4 more filings ↓Show fewer ↑up to 21d gap
- bd_c76c639d9bdb3a6dMontana State AGfiled 2023-07-21(6d gap)Verified
- bd_73c09f3ceeff8d69Delaware State AGfiled 2023-07-14(13d gap)Verified
- bd_94fc53d6e49a86b6Delaware State AGfiled 2023-07-14(13d gap)Candidate
- bd_53687e79813fbfd2New Hampshire State AGfiled 2023-08-17(21d gap)Verified
Source provenance
- Source URL
- https://cca.hawaii.gov/wp-content/uploads/2026/05/2023-0840.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 27, 2023
- Raw hash
- 2b42466f5eb04a788c351b66d2dd9b8de58a60ffef76beb6d7e6f8ac36613f58
Reporting entity
- Name
- Pension Benefit Information, LLCnorm: pension benefit information
- Domain
- mypensionbenefitinformation.com
Victim entity
- Name
- Teachers Insurance and Annuity Association of America ("TIAA")norm: teachers insurance and annuity association of america tiaa
Incident
- Discovered
- May 29, 2023
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 8 weeks(59 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.