Where does the TIAA case file come from?

Every entry is taken from the breach report TIAA lodged with the Maryland Attorney General. Nothing here is estimated.

Why do the incident date and the report date differ?

Companies usually investigate before they report. The gap between the two dates shows how long that took.

What does the records-affected figure count?

It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.

Does this case file change over time?

Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

Case file

Case File: TIAA Data Breach

This file collects the dated facts on record for the TIAA incident. The state report is dated March 12, 2025.

Timeline

March 12, 2025Report filed in MarylandDate the notice was lodged with the Maryland Attorney General.

Case facts

Filing state: Maryland
Date reported: March 12, 2025
Receiving office: Maryland Attorney General

Case notes

TIAA, a prominent financial services organization, officially filed notice of a data security incident with the Maryland Attorney General on March 12, 2025. This report confirms that the company is investigating unauthorized access to its systems.

The filing indicates that personal information of certain customers may have been affected. While the specific types of data involved were not detailed in the public record, TIAA has stated that individuals who received a notification letter should consider that their particular information was part of this event.

These notification letters are crucial as they provide specific details for each affected individual, explaining how the incident might impact them. Reviewing the content of any such letter will clarify what information was potentially compromised and TIAA's recommended next steps.

As a general precaution, individuals are advised to remain vigilant by monitoring their financial accounts for unusual activity and reviewing statements carefully. It is also recommended to be cautious of unsolicited communications, especially those requesting personal or sensitive details.

TIAA continues to investigate the scope and nature of this data security incident. The company's public report underscores its commitment to addressing the breach and informing affected individuals in accordance with regulatory requirements.

Questions about this case file

Where does the TIAA case file come from?: Every entry is taken from the breach report TIAA lodged with the Maryland Attorney General. Nothing here is estimated.
Why do the incident date and the report date differ?: Companies usually investigate before they report. The gap between the two dates shows how long that took.
What does the records-affected figure count?: It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.
Does this case file change over time?: Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

Maryland data breaches

Timeline

Case facts

Case notes

Questions about this case file

More Maryland case files