HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDFinancial accountEmploymentHighContained

TRANSAMERICA RETIREMENT SOLUTIONS, LLC

bd_d0db6979409708cf · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 16, 2018

Filed

Jun 1, 2018

To disclose

15 weeks

Affected · nationwide

2,836335 in this filing

Linked

3 filings

Confidence

64%

Full breach record for TRANSAMERICA RETIREMENT SOLUTIONS, LLC →10 incidents on file

Transamerica Retirement Solutions, LLC notified the Washington AG of a supplemental security incident involving unauthorized access to 335 Washington residents' accounts via compromised third-party credentials. Access occurred between March 2017 and January 2018. Data included names, SSNs, DOBs, financial account info, and employment details. 2,501 additional residents received informational notices. Kroll provided one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 352 days

discovery → filing · 15 weeks / 105 days

Mar 1, 2017

Begins

Feb 16, 2018

Discovered

Jun 1, 2018

Filed

vs. sector median

+7 wks slower

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Delaware State AGbd_21330dba5bfbf6972018-06-01Candidate
Massachusetts State AGbd_ca975f86c9333b432018-06-01Verified

Name: Alston & Bird LLP
norm: alston bird

Name: TRANSAMERICA RETIREMENT SOLUTIONS, LLC
norm: transamerica retirement
Domain: transamerica.com
Industry: Financial Servicesllm

Discovered: Feb 16, 2018
Breach occurred: Mar 1, 2017 – Jan 31, 2018
Undetected for: 352 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 1, 2018
Affected individuals: 2,836state + nationwide
Data types: Identity (basic)Government IDFinancial accountEmployment
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Submitted update to Washington Office of the Attorney General
Initial access: valid_credentials

During the incident: Arranged for Kroll Information Assurance to provide free credit monitoring services for one year
Flagged the affected accounts for special handling to prevent unauthorized access
Engaged a leading cybersecurity forensics firm
Contacted appropriate law enforcement
Changes made: Continue to work to minimize the impact of the incident
Enhance the security of the affected accounts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(105 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Delaware State AGJun 1 · first

Massachusetts State AGJun 1 · first

Washington State AGJun 1 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9575.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 1, 2018
Raw hash: b163f1938dd4032bd417e168a20d1b1cc50493811dd11e170760024ab3fb736d

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityAlston & Bird LLP

Victim entityTRANSAMERICA RETIREMENT SOLUTIONS, LLC

Incidentdiscovered Feb 16, 2018

Stated responseArranged for Kroll Information Assurance to provide free credit monitoring services for one year

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com