HackingVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTCriticalContained
Teachers Insurance and Annuity Association of America ("TIAA")
bd_a760fbad056957c0 · schema v1 · pii pii-v1
Full breach record for Teachers Insurance and Annuity Association of America ("TIAA") →Teachers Insurance and Annuity Association of America (TIAA) reported a data breach affecting 2,373,076 individuals, originating from a vulnerability in the MOVEit transfer software, a third-party vendor. The breach occurred on May 29, 2023, and was discovered on June 28, 2023. The compromised information includes names and Social Security numbers. TIAA offered affected individuals 24 months of identity theft protection services through Kroll.
Maine clockDiscovered Jun 28, 2023 → Filed with AG Jul 24, 202326d ✓ ME AG ≤30d26 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 9 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (8) · sorted by filing gap
- bd_dc7396da17f400f6California State AGfiled 2023-07-24Candidate
- bd_2ebc416a4ea0530dWashington State AGfiled 2023-07-27(3d gap)Verified
- bd_69cfd607fb6c4807Hawaii State AGfiled 2023-07-27(3d gap)Verified
- bd_7b3aede4e2719215California State AGfiled 2023-07-21(3d gap)Candidate
Show 4 more filings ↓Show fewer ↑up to 24d gap
- bd_c76c639d9bdb3a6dMontana State AGfiled 2023-07-21(3d gap)Verified
- bd_73c09f3ceeff8d69Delaware State AGfiled 2023-07-14(10d gap)Verified
- bd_94fc53d6e49a86b6Delaware State AGfiled 2023-07-14(10d gap)Candidate
- bd_53687e79813fbfd2New Hampshire State AGfiled 2023-08-17(24d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/ed67df63-aced-4ecb-91ce-602c7e34c83a.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 24, 2023
- Raw hash
- 036c2b7f7cf37a543a832e0bffdef24c5ba9ccfdac6d9d1db7393d560d9f5ed2
Reporting entity
- Name
- Teachers Insurance and Annuity Association of America ("TIAA")norm: teachers insurance and annuity association of america tiaa
Victim entity
- Name
- Teachers Insurance and Annuity Association of America ("TIAA")norm: teachers insurance and annuity association of america tiaa
Incident
- Discovered
- Jun 28, 2023
- Materiality determined
- —
- Notification sent
- Jul 14, 2023
- Affected individuals
- 2,373,076
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 26 days(26 days from discovery to filing)
- Compliance flags
- ME AG ≤30d · 26d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Jun 28, 2023→ Filed with AG: Jul 24, 202326d 30 days ME AG ≤30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.