HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Teachers Insurance and Annuity Association of America ("TIAA")
bd_73c09f3ceeff8d69 · schema v1 · pii pii-v1
Full breach record for Teachers Insurance and Annuity Association of America ("TIAA") →Pension Benefit Information, LLC (PBI), a third-party vendor for Teachers Insurance and Annuity Association of America (TIAA), disclosed a MOVEit Transfer vulnerability exploited by an unauthorized third party. The incident occurred May 29-30, 2023, involving the exfiltration of names, SSNs, DOBs, addresses, and gender. PBI patched servers, investigated, and offered 24 months of Kroll identity monitoring. No identity theft or fraud has been indicated.
This filing is one of 9 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (8) · sorted by filing gap
- bd_94fc53d6e49a86b6Delaware State AGfiled 2023-07-14Candidate
- bd_7b3aede4e2719215California State AGfiled 2023-07-21(7d gap)Candidate
- bd_c76c639d9bdb3a6dMontana State AGfiled 2023-07-21(7d gap)Verified
- bd_a760fbad056957c0Maine State AGfiled 2023-07-24(10d gap)Verified
Show 4 more filings ↓Show fewer ↑up to 34d gap
- bd_dc7396da17f400f6California State AGfiled 2023-07-24(10d gap)Candidate
- bd_2ebc416a4ea0530dWashington State AGfiled 2023-07-27(13d gap)Verified
- bd_69cfd607fb6c4807Hawaii State AGfiled 2023-07-27(13d gap)Verified
- bd_53687e79813fbfd2New Hampshire State AGfiled 2023-08-17(34d gap)Verified
Source provenance
- Source URL
- https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2023/07/TIAA-Individual-Notice.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 14, 2023
- Raw hash
- 598b306b6b3b8decac81817eb1a7420b58a860d1d739a44453093eb68bec848d
Reporting entity
- Name
- Pension Benefit Information, LLCnorm: pension benefit information
- Domain
- mypensionbenefitinformation.com
Victim entity
- Name
- Teachers Insurance and Annuity Association of America ("TIAA")norm: teachers insurance and annuity association of america tiaa
Incident
- Discovered
- —
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Initial access
- supply_chain
Compliance
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.