2026 TIAA — unauthorized acquisition; names + SSNs (MA notice; census unpublished)
Data compromised
Names and Social Security numbers; Massachusetts filing cites 13 residents; nationwide person census unpublished
Technical writeup
Verified Massachusetts OCABR sample notice (2026-1626) and ClaimDepot summary (Oct 5, 2026). TIAA discovered an unauthorized acquisition of personal information on September 8, 2026 and began notifying individuals on September 25, 2026. Exposed data types include names and Social Security numbers. Filing identifies 13 Massachusetts residents; national census unpublished — recordsAffected 0. Experian IdentityWorks offered for 24 months (enrollment deadline Dec 31, 2026). Distinct from older MOVEit/PBI vendor incidents. companyConfirmed true.
Root cause
Unauthorized acquisition of personal information (company notice; vector unpublished)