MisuseFinancial ServicesFinancePrivilege AbuseEmployee Data InvolvedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountCredentialsMediumContained

TIAA, FSB

bd_a6f620f9ca86fdff · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 13, 2022

Filed

Feb 21, 2023

To disclose

10 weeks

Affected

10state residents only

Linked

8 filings

Confidence

66%

Full breach record for TIAA, FSB →3 incidents on file

TIAA, FSB notified Montana residents of a data security incident involving a former employee with access to personal information. The incident was discovered on December 13, 2022. Data types included names, addresses, SSNs, financial account info, and credentials. TIAA engaged law enforcement and offered 24 months of Experian Identity Works.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 weeks / 70 days

Dec 13, 2022

Discovered

Feb 21, 2023

Filed

vs. sector median

+2 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Idaho State AGbd_0ea097812632083a2023-02-21Candidate
Maine State AGbd_3a438ba5fafcf9422023-02-21Verified
Massachusetts State AGbd_a8ea315a3b47e4ea2023-02-21Verified
Washington State AGbd_c1cf35d41dacca652023-02-21Verified

Show 3 more filings ↓up to 48d gap

Indiana State AGbd_264806535d03c2b22023-02-22 · +1dVerified
Massachusetts State AGbd_33c5719e50d893662023-02-15 · +6dVerified
Massachusetts State AGbd_d9d85c728eeb4c002023-04-10 · +48dCandidate

Name: TIAA, FSB
norm: tiaa fsb
Domain: tiaabank.com

Name: TIAA, FSB
norm: tiaa fsb
Domain: tiaabank.com
Industry: Financial Servicesllm

Discovered: Dec 13, 2022
Materiality determined: —
Notification sent: —
Affected individuals: 10state-resident count only
Data types: Identity (basic)Government IDFinancial accountCredentials
Data elements: Social Security numberDate of birth
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Initial access: insider_action

During the incident: Implemented incident response protocols
Engaged law enforcement
Offering complimentary access to Experian Identity Works for 24 months
Changes made: Implementing additional controls
Training and coaching
Performing immediate remediation activities
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(70 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 6 states

View merged incident ↗

Massachusetts State AGFeb 15 · first

Idaho State AG+6d

Maine State AG+6d

Massachusetts State AG+6d

Washington State AG+6d

Montana State AG+6d · this page

Indiana State AG+7d

Massachusetts State AG+54d

Pattern: first filing Feb 15 (MA), last Apr 10 (MA) — a 54-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-87.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 21, 2023
Raw hash: 966ef74720c8e1cebc4159c6bf976a46eaf6fee8c4c292b4020d520ab5bf516e

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityTIAA, FSB

Victim entityTIAA, FSB

Incidentdiscovered Dec 13, 2022

Stated responseImplemented incident response protocols

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov