HackingVulnerability ExploitData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
TIAA Kaspick, LLC
bd_fa66956c081fbea7 · schema v1 · pii pii-v1
Full breach record for TIAA Kaspick, LLC →TIAA Kaspick, LLC notified the Idaho Attorney General of a data security incident involving 150 Idaho residents. The breach stemmed from a vulnerability in Progress Software's MOVEit Transfer software exploited by an unauthorized third party via Pension Benefit Information, LLC (PBI), a third-party vendor. The attacker accessed PBI's MOVEit server on May 29-30, 2023, and exfiltrated files containing names, Social Security numbers, and dates of birth. TIAA Kaspick and PBI patched systems, investigated, and provided 24 months of credit monitoring to affected individuals.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_05f642e9efff15ccMaine State AGfiled 2023-07-27Verified
- bd_b82d3fc6babe68a1California State AGfiled 2023-07-27Verified
- bd_8ae2f91c9a2c0c12New Hampshire State AGfiled 2023-07-26(1d gap)Verified
- bd_f2b549864eb15db8Montana State AGfiled 2023-07-26(1d gap)Candidate
Source provenance
- Source URL
- https://www.ag.idaho.gov/content/uploads/2023/07/7-27-2023-TIAA-Kaspick-LLC.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 27, 2023
- Raw hash
- 3d3037ddf191f66924775b90f68b37cccbb1364f7c293bd7f427a3acba2a00ae
Reporting entity
- Name
- TIAA Kaspick, LLCnorm: tiaa kaspick
Victim entity
- Name
- TIAA Kaspick, LLCnorm: tiaa kaspick
Incident
- Discovered
- Jun 9, 2023
- Materiality determined
- —
- Notification sent
- Jul 14, 2023
- Affected individuals
- 150
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified Idaho Attorney General's Office
- Third party
- via Pension Benefit Information, LLC
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 7 weeks(48 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.