HackingVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
TD AMERITRADE CLEARING, INC.
bd_bbf1d3a4299b3121 · schema v1 · pii pii-v1
Full breach record for TD AMERITRADE CLEARING, INC. →TD Ameritrade, Inc. disclosed a data breach involving unauthorized access to its MOVEit Transfer software application between May 28 and May 30, 2023. The incident was discovered on May 30, 2023. Affected data includes names, Social Security numbers, financial account information, dates of birth, and government ID numbers. TD Ameritrade halted use of the software, engaged independent experts, notified law enforcement, and is offering two years of credit monitoring.
Leak gap clock⏱ Leak >30d10 weeks discovery → filing
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_5b823752842f2542New Hampshire State AGfiled 2023-08-09(1d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-571503
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 8, 2023
- Raw hash
- 6f037b357ab603d76c60aec3b58fa6b58215222715b2552d018e1e035166f07f
Reporting entity
- Name
- TD AMERITRADE CLEARING, INC.norm: td ameritrade clearing
- Domain
- tdameritrade.com
Victim entity
- Name
- TD AMERITRADE CLEARING, INC.norm: td ameritrade clearing
- Domain
- tdameritrade.com
Incident
- Discovered
- May 30, 2023
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Initial access
- supply_chain
Compliance
- Time to disclose
- 10 weeks(70 days from discovery to filing)
- Compliance flags
- Leak >30d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.