HackingVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Teachers' Retirement System of the City of New York
bd_96f1aacb96ef4caa · schema v1 · pii pii-v1
Full breach record for Teachers' Retirement System of the City of New York →Teachers’ Retirement System of the City of New York (TRS NYC) notified the NH AG of a data breach involving third-party vendor PBI Research Services. An unauthorized party exploited a vulnerability in PBI's MOVEit Transfer software on May 29-30, 2023, downloading data of TRS payees. PBI notified TRS on June 6, 2023. Affected data included names, SSNs, and benefit info. TRS and PBI are offering credit monitoring.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_794f98c2009ad2ecMaine State AGfiled 2023-07-24Candidate
- bd_e208ddf047767168Montana State AGfiled 2023-07-24Verified
- bd_fe91f5d522ee5407California State AGfiled 2023-07-24Verified
- bd_b129a13df14ad5f0Vermont State AGfiled 2023-07-18(6d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/teachers-retirement-system-city-new-york-20230724.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 24, 2023
- Raw hash
- 198ca3a44b2ba4a6eea5360f647bc03959dd3e042d35884c94676671a1f54dd8
Reporting entity
- Name
- Teachers' Retirement System of the City of New Yorknorm: teachers retirement system of the city of new york
Victim entity
- Name
- Teachers' Retirement System of the City of New Yorknorm: teachers retirement system of the city of new york
Incident
- Discovered
- Jun 6, 2023
- Materiality determined
- —
- Notification sent
- Jul 18, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified New Hampshire Attorney General Consumer Protection Bureau
- Third party
- via PBI Research Services
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 7 weeks(48 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.