USAA usaa.com USAA data breach: what happened and what to do
A document delivery error at USAA, starting April 13, 2024, put documents for some property and casualty insurance members into another member's online account. USAA told regulators 32,276 people were affected. Letters went out from August 27, 2024.
View all 13,115 breaches- Breach date
- 13 Apr 2024
- Affected
- 32,276
- Data exposed
- Names, Physical addresses, Dates of birth, Social security numbers, Driver's licenses, Medical information
- Last updated
What happened
USAA, the insurer and bank that serves military members and their families, reported a data incident that began on April 13, 2024. According to its notices, a routine update to its document delivery system caused some documents for members with property and casualty insurance to be posted by mistake to another member's online account.
This was not a hack. No outside attacker is named in the notices. The exposure was members seeing other members' paperwork, and that still counts as a breach under state law because personal data reached people who shouldn't have had it.
USAA's filing with the Maine Attorney General lists 32,276 people affected in total, 156 of them in Maine. The breach period is given as April 13 to April 30, 2024, and the filing says USAA discovered the problem on July 31, 2024. USAA began mailing letters on August 27, 2024. It reported the incident to California as well.
What was exposed
Reports on the notices list names, addresses, dates of birth, Social Security numbers, driver's license numbers, medical information and property and casualty policy details. Not every person had every item. The letter you received, if you got one, lists what applied to you.
Social Security numbers and dates of birth are the items that matter most. Together with a name and address they are what criminals use to open credit accounts or file fraudulent tax returns in someone's name.
The company's response
USAA offered affected people a two-year membership to Experian IdentityWorks, a credit monitoring service. It said its investigation found no evidence of fraud or identity theft from the incident. If you got a letter, the activation code in it is worth using.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A freeze stops new credit being opened in your name. It is free at Equifax, Experian and TransUnion. The FTC explains how it works and how to lift it when you need credit.
- 2
Use the free credit monitoring if it is offered
If your USAA letter includes an Experian IdentityWorks code, activate it. USAA offered a two-year membership. Check the letter for the enrollment deadline.
- 3
Read your statements and explanation of benefits
Look for accounts, charges or medical bills you don't recognize, and report them to the company right away.
- 4
Expect phishing that quotes real details
Scammers use leaked names and addresses to sound legitimate. Don't give out your Social Security number or card details to anyone who contacts you first.
- 5
Check whether your email or phone is in this and other breaches
Serus monitors breach databases and the dark web and alerts you when your email, passwords or other personal data appear, and tells you what to do next. It can't remove data that has already leaked, so the alert is the point: it tells you which passwords to change. You can run a free scan.
Frequently asked
Was I affected by the USAA data breach?
USAA mailed letters starting August 27, 2024 to the 32,276 people it counted. If you hold or held a USAA property and casualty insurance product and got no letter, you can ask USAA directly.
What was exposed?
Reports on the notices list names, addresses, dates of birth, Social Security numbers, driver's license numbers, medical information and policy details. It varied by person.
Was USAA hacked?
The notices describe an error in a document delivery system update, not an outside attack.
Is there free credit monitoring?
USAA offered a two-year Experian IdentityWorks membership to affected people. Use the code in your letter.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
