Where does the 2TIAA case file come from?

Every entry is taken from the breach report 2TIAA lodged with the Indiana Attorney General. Nothing here is estimated.

Why do the incident date and the report date differ?

Companies usually investigate before they report. The gap between the two dates shows how long that took.

What does the records-affected figure count?

It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.

Does this case file change over time?

Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

Case file

Case File: 2TIAA Data Breach

This file collects the dated facts on record for the 2TIAA incident. The state report is dated September 25, 2026. The incident itself is dated August 31, 2026.

Timeline

25 days separate the incident date from the date it was reported.

August 31, 2026Incident dateWhen the filing says the breach took place.
September 25, 2026Report filed in IndianaDate the notice was lodged with the Indiana Attorney General.

Case facts

Filing state: Indiana
Date reported: September 25, 2026
Incident date: August 31, 2026
Receiving office: Indiana Attorney General

Case notes

On September 25, 2026, 2TIAA submitted official notification regarding a data breach. This incident, which the company states occurred on August 31, 2026, involves the potential exposure of personal information. The filing was made publicly available for review, documenting the event for affected individuals.

The specific nature of how the breach occurred and the exact categories of data involved were not detailed in the public record. 2TIAA has indicated that it is currently monitoring the situation following the event. Those impacted by this breach should be aware that their personal information may have been compromised.

If you have received a direct notification from 2TIAA concerning this data security incident, it is crucial to read the letter thoroughly. This official communication will provide the most accurate and personalized details about the incident and any protective measures offered by the company.

As a general precaution, it is advisable to remain vigilant for any unusual activity across your accounts. Consider placing a fraud alert or credit freeze with credit bureaus, and regularly review your financial statements and credit reports. Updating passwords for online services, especially those using similar credentials, is also a recommended step to enhance your digital security.

Questions about this case file

Where does the 2TIAA case file come from?: Every entry is taken from the breach report 2TIAA lodged with the Indiana Attorney General. Nothing here is estimated.
Why do the incident date and the report date differ?: Companies usually investigate before they report. The gap between the two dates shows how long that took.
What does the records-affected figure count?: It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.
Does this case file change over time?: Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

Indiana data breaches

Filing source: Indiana Attorney General

Named in the 2TIAA breach?

Attach your notice and a short note. An attorney checks it against this case file at no cost.

Timeline

Case facts

Case notes

Questions about this case file

More Indiana case files