Teachers Insurance and Annuity Association of America Hit with Class Action Over May 2023 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

Teachers Insurance and Annuity Association of America (TIAA) faces a proposed class action over a May 2023 data breach that reportedly exposed the personal information of approximately 2.3 million individuals.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 59-page lawsuit claims TIAA, a financial organization that provides retirement plans, investment management, life insurance and other services to millions of individuals at over 15,000 institutions, announced in July 2023 that it had been affected by a data breach that targeted MOVEit, a widely used file transfer platform.

According to a July 14 notice letter sent on the company’s behalf, Pension Benefit Information (PBI), a third-party vendor TIAA partners with for its audit and address research services, uses MOVEit to transfer files. Consequently, personal information belonging to current and former employees of organizations that used TIAA’s services was compromised when an unauthorized party accessed one of PBI’s MOVEit transfer servers between May 29 and 30 of this year, the case contends.

Data stolen in the incident includes consumers’ full names, addresses, dates of birth, gender and Social Security numbers, the filing specifies.

The complaint argues that TIAA’s involvement in the MOVEit security incident was a result of its failure to implement adequate cybersecurity measures. Per the lawsuit, TIAA left consumers’ highly sensitive information unencrypted on an “insecure platform, accessible to unauthorized parties from the internet,” despite the “known risk” of a data breach.

“[The defendant] could have prevented this Data Breach by, among other things, properly encrypting the data that it shares with others or properly monitoring, auditing or verifying the integrity of its IT vendors’ and partners’ data security equipment and procedures,” the lawsuit charges.

The plaintiff, a former teacher that used TIAA for her retirement savings, received notice on July 14 that her personal data had been compromised in the MOVEit cyberattack, the suit says. Like other victims, the woman now faces a lifelong risk of fraud and identity theft and may be forced to pay out-of-pocket to purchase credit monitoring services, credit freezes, credit reports and other measures designed to prevent such illegal activity, the case claims.

The lawsuit looks to represent anyone whose personally identifiable information was maintained on Teachers Insurance and Annuity Association of America’s computer systems that were compromised in the data breach, including those who were sent a notice letter from the defendant and/or Pension Benefit Information.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.