HackingData MishandlingData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedDelayed DiscoveryIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASICHighActive
Tiaa-cref Life Insurance Company
bd_eb98cd8aab9e94a4 · schema v1 · pii pii-v1
Full breach record for Tiaa-cref Life Insurance Company →TIAA-CREF Life Insurance Company notified the Idaho Attorney General of a cybersecurity event involving third-party administrator Infosys McCamish Systems. The incident, discovered on November 3, 2023, resulted in the potential exfiltration of customer data, including names, SSNs, DOBs, financial account numbers, and medical information. Approximately 1,300 Idaho residents are receiving voluntary notices and two years of free identity theft protection.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,300 affectedView incident
Source provenance
- Source URL
- https://www.ag.idaho.gov/content/uploads/2024/02/2-18-2024-TIAA-CREF-Life-Insurance-Company.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 18, 2024
- Raw hash
- 47bf9142d48b8cf2afe42a4bba3e178b1ba7005ab7c08b9c8c92bd051f636797
Reporting entity
- Name
- Tiaa-cref Life Insurance Companynorm: tiaa cref life insurance
Victim entity
- Name
- Tiaa-cref Life Insurance Companynorm: tiaa cref life insurance
Incident
- Discovered
- Nov 3, 2023
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- 1,300
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified Idaho Office of the Attorney General
- Third party
- via Infosys McCamish Systems (McCamish)
- Initial access
- supply_chain
Compliance
- Time to disclose
- 15 weeks(107 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.