HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDMediumContained

TIAA and TIAA Life

bd_6eb1a6f360898450 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Apr 17, 2018

To disclose

—

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for TIAA and TIAA Life →9 incidents on file

TIAA notified Montana residents that an unauthorized third party viewed their personal identifiable information, including name, account balance, and Social Security number, online. TIAA disabled affected accounts and offered two years of credit monitoring and identity protection services through AllClear ID.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Apr 17, 2018

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_2b758dbb9400db152018-04-02 · +15dCandidate

Name: TIAA and TIAA Life
norm: tiaa and tiaa life
Domain: tiaa.org

Name: TIAA and TIAA Life
norm: tiaa and tiaa life
Domain: tiaa.org
Industry: Financial Servicesllm

Discovered: —
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Shut down access to your information
Disabled your login to your online account
Offering you identity repair assistance, credit monitoring, identity protection services and $1,000,000 in identity theft insurance coverage through AllClear ID at TIAA’s expense for two years
Changes made: Offering you identity repair assistance, credit monitoring, identity protection services and $1,000,000 in identity theft insurance coverage through AllClear ID at TIAA’s expense for two years
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGApr 2 · first

Montana State AG+15d · this page

Pattern: first filing Apr 2 (MA), last Apr 17 (MT) — a 15-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/TIAA-1.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 17, 2018
Raw hash: 1690ca9a0300fb48ec7c6b53cab6e75fb47f0fbec1d4b5fa4d2620f1c92111f3

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityTIAA and TIAA Life

Victim entityTIAA and TIAA Life

IncidentUnauthorized Access

Stated responseShut down access to your information

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov