TIAA-CREF INDIVIDUAL & INSTITUTIONAL SERVICES, LLC

TIAA reported a cybersecurity incident involving one Maryland resident. An unauthorized individual accessed the resident's TIAA account between January 4 and January 6, 2025, using valid credentials obtained from an unknown external source. TIAA reset the credentials, placed additional authentication monitoring, and offered 24 months of complimentary credit monitoring.

On March 5, 2025, an unauthorized individual accessed a Maryland resident's TIAA online account using credentials obtained from an external source. The attacker viewed the resident's name, user ID, account number, and financial account balance. TIAA deactivated the compromised credentials, placed account alerts, and offered two years of credit monitoring. No unauthorized transactions occurred.

TIAA CREF Financial Services reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2013-04-20. 46 Massachusetts residents were affected. The report records the breach type as undefined.