HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Teachers Insurance and Annuity Association of America ("TIAA")
bd_94fc53d6e49a86b6 · schema v1 · pii pii-v1
Full breach record for Teachers Insurance and Annuity Association of America ("TIAA") →Pension Benefit Information, LLC (PBI) notified Delaware AG that a third-party software vulnerability in Progress Software's MOVEit Transfer was exploited between May 29-30, 2023. PBI, a vendor for Teachers Insurance and Annuity Association of America (TIAA), allowed an unauthorized third party to access a server and download data. Affected data included names, SSNs, dates of birth, addresses, and gender. PBI patched servers, investigated, and offered 24 months of identity monitoring via Kroll. No identity theft or fraud has been indicated.
This filing is one of 9 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (8) · sorted by filing gap
- bd_73c09f3ceeff8d69Delaware State AGfiled 2023-07-14Verified
- bd_7b3aede4e2719215California State AGfiled 2023-07-21(7d gap)Candidate
- bd_c76c639d9bdb3a6dMontana State AGfiled 2023-07-21(7d gap)Verified
- bd_a760fbad056957c0Maine State AGfiled 2023-07-24(10d gap)Verified
Show 4 more filings ↓Show fewer ↑up to 34d gap
- bd_dc7396da17f400f6California State AGfiled 2023-07-24(10d gap)Candidate
- bd_2ebc416a4ea0530dWashington State AGfiled 2023-07-27(13d gap)Verified
- bd_69cfd607fb6c4807Hawaii State AGfiled 2023-07-27(13d gap)Verified
- bd_53687e79813fbfd2New Hampshire State AGfiled 2023-08-17(34d gap)Verified
Source provenance
- Source URL
- https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2023/07/TIAA-Individual-Notice.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 14, 2023
- Raw hash
- 31d4646dbc82d78d6bb43d0f8e55b27e3f72338af1649a7957a611e14b6a4f2f
Reporting entity
- Name
- Pension Benefit Information, LLCnorm: pension benefit information
- Domain
- mypensionbenefitinformation.com
Victim entity
- Name
- Teachers Insurance and Annuity Association of America ("TIAA")norm: teachers insurance and annuity association of america tiaa
Incident
- Discovered
- May 29, 2023
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Third party
- via Progress Software
- Initial access
- supply_chain
Compliance
- Time to disclose
- 7 weeks(46 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.