HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedIdentity (basic)Financial accountLowContained

TIAA-CREF INDIVIDUAL & INSTITUTIONAL SERVICES, LLC

bd_fe15c2d8a1155409 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 5, 2025

Filed

Mar 12, 2025

To disclose

7 days

Affected

1state residents only

Confidence

66%

Full breach record for TIAA-CREF INDIVIDUAL & INSTITUTIONAL SERVICES, LLC →3 incidents on file

On March 5, 2025, an unauthorized individual accessed a Maryland resident's TIAA online account using credentials obtained from an external source. The attacker viewed the resident's name, user ID, account number, and financial account balance. TIAA deactivated the compromised credentials, placed account alerts, and offered two years of credit monitoring. No unauthorized transactions occurred.

J jump to incidentP pin to compareR raw source

Maryland clock✓ MD AG ≤30d7 days discovery → filing

Incident timeline

discovery → filing · 7 days

Mar 5, 2025

Begins

Mar 5, 2025

Discovered

Mar 12, 2025

Filed

vs. sector median

7 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: TIAA-CREF INDIVIDUAL & INSTITUTIONAL SERVICES, LLC
norm: tiaa cref individual institutional
Domain: tiaa.org

Name: TIAA-CREF INDIVIDUAL & INSTITUTIONAL SERVICES, LLC
norm: tiaa cref individual institutional
Domain: tiaa.org
Industry: Financial Servicesllm

Discovered: Mar 5, 2025
Breach occurred: Mar 5, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 12, 2025
Affected individuals: 1state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Maryland Office of the Attorney General
Initial access: valid_credentials

During the incident: Deactivated the individual’s credentials so that the client can create new credentials
Placed alerts on the client’s accounts
Placed additional authentication monitoring to your TIAA account
Offered complimentary access to Experian IdentityWorks for 24 months
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 days(7 days from discovery to filing)
Compliance flags: MD AG ≤30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376544.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 12, 2025
Raw hash: 9ea69a72606d452255431bd3d2525267ed86e578f2bf675fbc4be91e0f9b935c

Reporting entityTIAA-CREF INDIVIDUAL & INSTITUTIONAL SERVICES, LLC

Victim entityTIAA-CREF INDIVIDUAL & INSTITUTIONAL SERVICES, LLC

Incidentdiscovered Mar 5, 2025

Stated responseDeactivated the individual’s credentials so that the client can create new credentials

ComplianceMD AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov