TIAA Discloses Data Breach Exposing Social Security Numbers

Major U.S. financial services company with over $1 trillion in assets,, TIAA, disclosed a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation on Sept. 25, 2026, with 13 Massachusetts residents identified as affected.

TIAA discovered the breach on Sept. 8, 2026, and began notifying affected individuals on Sept. 25, 2026, according to the company's notification letter.

TIAA described the incident as an "unauthorized acquisition" of personal information, according to the company's notification letter to affected individuals.

The types of personally identifiable information exposed in the breach included names and Social Security numbers.

TIAA's response to the breach

Given that Social Security numbers were among the information exposed, TIAA is offering affected individuals 24 months of complimentary Experian IdentityWorks membership. The service includes credit monitoring across all three major credit bureaus: Equifax, Experian and TransUnion.

The monitoring service provides an Experian credit report at the time of enrollment, with daily credit reports available for online members. Offline members are eligible to call for additional reports on a quarterly basis after enrolling, according to the notification. The membership also includes internet surveillance technology that searches the web, chat rooms and bulletin boards around the clock to detect whether personal information is being traded or sold on the dark web.

Identity restoration specialists are available immediately to help affected individuals address both credit-related and non-credit-related fraud. According to the notification, if an individual believes their information has been misused as a result of the breach, an Experian agent can investigate and help resolve each incident of fraud that occurred from the date of the incident. This assistance includes helping to dispute fraudulent charges with credit grantors, close unauthorized accounts, place credit freezes with the credit bureaus and contact government agencies to help restore an individual's identity.

TIAA noted that identity restoration support is available for 24 months from the date of the notification letter and does not require any action from affected individuals at this time.

The Experian IdentityWorks membership also includes up to $1 million in identity theft insurance, underwritten and administered by American Bankers Insurance Company of Florida, an Assurant company. Terms, conditions and exclusions of coverage apply, and coverage may not be available in all jurisdictions, according to the notification. Additional features include lost wallet assistance, which helps with canceling and replacing lost or stolen credit, debit and medical cards.

For households with children, the membership includes child monitoring for up to 10 children under age 18. This feature provides internet surveillance, monitoring to check whether enrolled minors have an Experian credit report, identity restoration support and up to $1 million in identity theft insurance.

Even after the 24-month membership expires, affected individuals will continue to receive identity restoration support through Experian IdentityWorks ExtendCare, according to the notification.

To activate the full monitoring service, affected individuals should visit the Experian IdentityWorks enrollment page and enter the unique activation code included in their notification letter. Enrollment must be completed by Dec. 31, 2026, and no credit card is required. The terms and conditions for the identity restoration offer are available online.

TIAA has established two phone lines for affected individuals. For questions about Experian IdentityWorks or identity restoration services, individuals can call 833-931-7577, Monday through Friday, 9 a.m. to 9 p.m. ET (excluding major U.S. holidays). Callers should be prepared to provide their engagement number as proof of eligibility. For all other questions about the breach, individuals can reach TIAA directly at 800-517-7344, Monday through Friday, 8 a.m. to 10 p.m. ET.