MisuseFinancial ServicesFinancePrivilege AbuseData MishandlingSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountFinancial credentialsMinorMediumContained

USAA Federal Savings Bank

bd_f27f736cf8e7739c · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jun 21, 2023

To disclose

—

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for USAA Federal Savings Bank →11 incidents on file

USAA reported that call center representatives of a third-party service provider improperly shared USAA access credentials with unauthorized individuals between December 20, 2022, and May 18, 2023. This allowed unauthorized access to personal information of USAA members, including names, addresses, driver's license numbers, last four digits of SSNs, bank account numbers, and authentication PINs. USAA blocked the access and is monitoring accounts. Complimentary identity monitoring services were offered to affected adults and minors.

J jump to incidentP pin to compareR raw source

Incident timeline

Dec 20, 2022

Begins

Jun 21, 2023

Filed

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Washington State AGbd_cc3470b585b24bdf2023-06-21Candidate

Name: USAA Federal Savings Bank
norm: usaa federal savings bank

Name: USAA Federal Savings Bank
norm: usaa federal savings bank
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Dec 20, 2022 – May 18, 2023
Materiality determined: —
Notification sent: Jun 22, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountFinancial credentialsMinor
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Partner
Third party: via third-party service provider
Initial access: trusted_relationship

During the incident: Blocked the unauthorized access
Monitoring your account(s) for any suspicious activity related to the incident
Offering a complimentary two-year membership of Experian’s IdentityWorks program
Offering a complimentary two-year membership of Experian’s Minor Plus program
Changes made: Working with the service provider to enhance its security measures and control environment to help protect against similar incidents in the future
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Washington State AGJun 21 · first

California State AGJun 21 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-568287
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 21, 2023
Raw hash: 327e8d29b0395f25f69f05de6226387e41b36898bf5d731ac0327799d9df47c8

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityUSAA Federal Savings Bank

Victim entityUSAA Federal Savings Bank

IncidentThird-Party / Supply Chain

Stated responseBlocked the unauthorized access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov