HackingVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_GOVERNMENTIDENTITY_BASICMediumContained
Teachers Insurance and Annuity Association of America ("TIAA")
bd_dc7396da17f400f6 · schema v1 · pii pii-v1
Full breach record for Teachers Insurance and Annuity Association of America ("TIAA") →Teachers Insurance and Annuity Association of America (TIAA) notified the California AG of a data breach involving its third-party vendor, Pension Benefit Information, LLC (PBI). An unauthorized third party exploited a vulnerability in Progress Software's MOVEit Transfer software, accessing PBI's servers on May 29-30, 2023, and downloading data. Affected information includes names, Social Security numbers, dates of birth, addresses, and gender. TIAA/PBI patched servers, investigated the incident, and offered 24 months of identity monitoring via Kroll.
This filing is one of 9 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (8) · sorted by filing gap
- bd_a760fbad056957c0Maine State AGfiled 2023-07-24Verified
- bd_2ebc416a4ea0530dWashington State AGfiled 2023-07-27(3d gap)Verified
- bd_69cfd607fb6c4807Hawaii State AGfiled 2023-07-27(3d gap)Verified
- bd_7b3aede4e2719215California State AGfiled 2023-07-21(3d gap)Candidate
Show 4 more filings ↓Show fewer ↑up to 24d gap
- bd_c76c639d9bdb3a6dMontana State AGfiled 2023-07-21(3d gap)Verified
- bd_73c09f3ceeff8d69Delaware State AGfiled 2023-07-14(10d gap)Verified
- bd_94fc53d6e49a86b6Delaware State AGfiled 2023-07-14(10d gap)Candidate
- bd_53687e79813fbfd2New Hampshire State AGfiled 2023-08-17(24d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-570764
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 24, 2023
- Raw hash
- 962267819238d764d6b1a6b8e03e4dc6077f03b8674174bedeeae95765a0b4f6
Reporting entity
- Name
- Pension Benefit Information, LLCnorm: pension benefit information
- Domain
- mypensionbenefitinformation.com
Victim entity
- Name
- Teachers Insurance and Annuity Association of America ("TIAA")norm: teachers insurance and annuity association of america tiaa
Incident
- Discovered
- May 31, 2023
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Third party
- via Progress Software
- Initial access
- supply_chain
Compliance
- Time to disclose
- 8 weeks(54 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.