TIAA tiaa.org TIAA data breach 2023: what happened and what to do
Infosys McCamish Systems, a service provider to TIAA, was hit by ransomware starting October 29, 2023. TIAA says its own systems weren't breached, but client data held by the provider was accessed. TIAA filed a notice with California's Attorney General on September 6, 2024.
View all 13,177 breaches- Breach date
- 29 Oct 2023
- Made public
- 6 Sept 2024
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Infosys McCamish Systems (IMS) runs administrative services for insurance and retirement firms, TIAA among them. According to the notice letters, IMS suffered a ransomware attack on October 29, 2023, and there was unauthorized activity on its network until November 2, 2023.
TIAA says its own systems weren't compromised. The exposed data was information about TIAA clients that IMS held on TIAA's behalf. TIAA sent a notice to people in February 2024, in a letter filed with the Idaho Attorney General, and then listed the breach with the California Attorney General on September 6, 2024.
Sources checked: ag.idaho.gov, oag.ca.gov, consumer.ftc.gov
Last verified against the official page:
What was exposed
TIAA said it couldn't confirm exactly what was accessed for each person. The letter says the information could include some or all of a list of data elements, among them financial account numbers and medical information. Check your own letter for your list: it differs from person to person.
The notices say neither TIAA nor IMS knew of any fraudulent use of the information at that point.
What it means for you
Financial account numbers and medical details can be used to target you with convincing calls and emails about your account or your benefits. If a Social Security number is on your letter, someone could try to open credit in your name.
What to do if you were in it
- 1
Read your notice letter for what it lists
Your letter says which of your details were involved and offers any free monitoring. Use it to decide the steps below.
- 2
Watch your accounts and statements
Check your TIAA, bank and insurance statements for activity you don't recognize, and tell the institution straight away if something looks off.
- 3
Freeze your credit if a Social Security number was involved
A freeze is free and stops lenders seeing your report. You place it at Equifax, Experian and TransUnion separately.
- 4
Be careful with calls and emails about your account
Hang up on unexpected calls and don't click links in messages that mention your TIAA account. Contact TIAA using the number on its website or your statement.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan with Serus. It monitors breach databases and the dark web and alerts you when your details show up.
Official filings
- California Attorney General , filed 6 Sept 2024
Timeline
-
The breach happened
-
The company made it public
-
Reported to the California Attorney General
Frequently asked
Was TIAA itself hacked?
TIAA says its own systems weren't breached. The attack was on Infosys McCamish Systems, a service provider that held TIAA client data.
What was exposed in the TIAA data breach?
It depends on the person. TIAA's letter says it could include some or all of a list of data elements, including financial account numbers and medical information. Your own notice states yours.
Should I freeze my credit?
If your notice lists a Social Security number, yes. The FTC says a credit freeze is free and you place it at each of the three bureaus.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
