HackingVulnerability ExploitData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)IDENTITY_BASICLowContained
TIAA Kaspick, LLC
bd_8ae2f91c9a2c0c12 · schema v1 · pii pii-v1
Full breach record for TIAA Kaspick, LLC →TIAA Kaspick, LLC notified the NH Attorney General of a data security incident involving its third-party vendor, Pension Benefit Information, LLC (PBI). PBI's MOVEit Transfer server was exploited by an unauthorized third party on May 29-30, 2023, resulting in the exfiltration of files containing personal information of 353 New Hampshire residents. TIAA Kaspick learned of the investigation on June 9, 2023. Notifications were mailed starting July 14, 2023, offering credit monitoring services.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_f2b549864eb15db8Montana State AGfiled 2023-07-26Candidate
- bd_05f642e9efff15ccMaine State AGfiled 2023-07-27(1d gap)Verified
- bd_b82d3fc6babe68a1California State AGfiled 2023-07-27(1d gap)Verified
- bd_fa66956c081fbea7Idaho State AGfiled 2023-07-27(1d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/tiaa-kaspick-20230726.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 26, 2023
- Raw hash
- 4374c285f015b6d1dbf4435a02bc032b3a8a28abf57b8c8d9c67b9d3a7de5110
Reporting entity
- Name
- TIAA Kaspick, LLCnorm: tiaa kaspick
Victim entity
- Name
- TIAA Kaspick, LLCnorm: tiaa kaspick
Incident
- Discovered
- Jun 9, 2023
- Materiality determined
- —
- Notification sent
- Jul 14, 2023
- Affected individuals
- 353
- Data types
- IDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 7 weeks(47 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.