Teachers Insurance and Annuity

TIAA-CREF Life Insurance Company notified the Idaho AG of a cybersecurity event at its vendor, Infosys McCamish Systems, discovered on November 3, 2023. The vendor suffered a breach potentially resulting in the exfiltration of customer data, including names, SSNs, DOBs, policy numbers, financial account numbers, and medical information. TIAA terminated connections to the vendor and scanned its own systems, finding no compromise. Approximately 1,300 Idaho residents are estimated to be impacted. The investigation into the scope of data exfiltration is ongoing, with results expected in July 2024. TIAA is offering two years of identity theft protection.

TIAA-FREF LIFE INS. CO. filed a data-breach notice with the Illinois Attorney General in February 2024 (case 24-02-185). The register records the breach as discovered on November 3, 2023. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

TIAA-CREF Life Insurance Company reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-08-02. 1,701 Massachusetts residents were affected. The report records the breach type as electronic.

Pension Benefit Information, LLC (PBI) notified TIAA-Cref Life Insurance Company customers of a data breach involving the MOVEit Transfer software vulnerability. An unauthorized third party accessed PBI servers on May 29-30, 2023, downloading data including names, SSNs, DOBs, addresses, and gender. PBI patched servers, investigated, and is offering 24 months of identity monitoring.

Pension Benefit Information, LLC (PBI), a third-party vendor for TIAA-CREF Life Insurance Company, disclosed a cyberattack involving the MOVEit Transfer software vulnerability. The unauthorized third party accessed a PBI server on May 29-30, 2023, downloading data including names, SSNs, DOBs, addresses, and gender. PBI notified affected individuals and offered 24 months of identity monitoring. 904 Washington residents were affected.

TIAA-CREF Life Insurance Company notified the Idaho Attorney General of a data security incident involving its third-party vendor, Pension Benefit Information, LLC (PBI). PBI's MOVEit Transfer server was exploited between May 29-30, 2023, leading to the exfiltration of files containing names, SSNs, dates of birth, addresses, and gender of 162 Idaho residents. TIAA and PBI investigated, identified affected individuals, and provided 2 years of free credit monitoring and identity theft restoration services.

TIAA-CREF Life Insurance Company notified the California AG of a data breach involving its third-party service provider, Pension Benefit Information, LLC (PBI). An unauthorized third party exploited a vulnerability in Progress Software's MOVEit Transfer product to access PBI's servers on May 29-30, 2023, and exfiltrated data. The compromised information included names, Social Security numbers, dates of birth, addresses, and gender. PBI patched servers, investigated the incident, and is offering 24 months of identity monitoring to affected individuals.

TIAA‐CREF Life Insurance Company reported a data breach to the Indiana Attorney General. The breach occurred on 2023-05-29 and was reported on 2023-07-28. 723 Indiana residents were affected. 42,922 individuals affected in total.

TIAA-CREF LIFE INS. CO. filed a data-breach notice with the Illinois Attorney General during 2023 (case 23-511). The register records the breach as discovered on May 29, 2023. Additional entities named: MOVEIT, PBI. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

TIAA-CREF LIFE INS. CO. filed a data-breach notice with the Illinois Attorney General during 2023 (case 23-480). The register records the breach as discovered on May 31, 2023. Additional entities named: MOVEIT, PBI. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.