The Maine Office of the Attorney General reported a data breach incident involving the United Services Automobile Association (USAA) on August 28, 2024. The breach, which occurred on April 30, 2024, involved an internal system error that potentially exposed personal information for 32,276 individuals, including 156 residents of Maine. Identity theft protection services were offered in the form of a 24-month membership to Experian's IdentityWorks program.

The Vermont Office of the Attorney General reported on June 22, 2023, that the United Services Automobile Association (USAA) experienced a data breach due to improperly shared access credentials by call center representatives. The breach incident occurred between December 20, 2022, and May 18, 2023, affecting an unspecified number of members' personal information.

USAA Data Breaches Expose Sensitive Military Member Data in Three Separate Incidents (2021–2024) Between 2021 and 2024, USAA one of the largest financial institutions serving active-duty military, veterans, and their families disclosed three major data breaches, each stemming from different vulnerabilities. The incidents compromised the personal and financial information of over 73,000 members, with risks amplified by the high-value nature of military identities in fraud schemes. ### 2021: Exploited Insurance Quote Tool In May 2021, attackers leveraged a flaw in USAA’s online insurance quote tool, which lacked rate limiting and CAPTCHA controls. By cycling through stolen personal data from other breaches, criminals matched records to active USAA accounts, exposing driver’s license numbers and other PII for 22,383 members (12,627 in New York alone). The breach led to a $3.25 million class-action settlement, with affected members eligible for payouts averaging $143 per claim. ### 2022–2023: Third-Party Contractor Credential Abuse From December 20, 2022, to May 18, 2023, call center representatives at a USAA third-party vendor shared login credentials with unauthorized individuals, granting access to member accounts. The breach exposed names, addresses, partial Social Security numbers, bank details, PINs, and debit/credit card numbers for ~19,000 members. A smaller, unrelated incident in August 2023 involved another contractor mishandling data, though the number of affected members was undisclosed. USAA offered two years of free Experian IdentityWorks monitoring to victims, who were not notified until June 26, 2023 over a month after the breach window closed. ### 2024: Internal System Error Leaks Documents On April 13, 2024, a routine system update misconfigured USAA’s document delivery platform, causing 32,276 members’ files including Social Security numbers, medical records, and insurance policy details to be visible to other users. USAA detected the error on April 30 but did not notify affected members until August 27, sparking a lawsuit alleging negligence and delayed disclosure. While no fraud was reported, the exposed data posed significant identity theft risks. ### Legal and Security Fallout - The 2021 breach resulted in the $3.25 million settlement, with claims still open. - The 2024 incident prompted a lawsuit over delayed notifications. - USAA has not attributed any breach to a nation-state actor or organized hacking group; instead, failures ranged from design flaws to third-party insider threats and internal errors. - Affected members received free Experian IdentityWorks monitoring, though experts note this service is not the most robust option for identity protection. ### Impact on Military Members USAA’s breaches are particularly concerning due to its military-affiliated customer base, whose data carries higher trust signals in financial systems. Stolen information such as Social Security numbers, bank details, and medical records enables fraudsters to open fraudulent accounts, file false benefits claims, or conduct targeted phishing attacks. The incidents underscore vulnerabilities in third-party vendor oversight, system design, and change management, none of which required sophisticated cyberattacks to exploit.