CalSTRS and one of our vendors, PBI Research Services (PBI), used a file transfer application hosted by PBI to transmit files containing member information. PBI informed CalSTRS that a vulnerability in that file transfer application was exploited and an unauthorized party acquired files containing certain CalSTRS members’ information.

CalSTRS carefully examined the files PBI reported were involved and determined that they contained the name and Social Security numbers, date of birth and zip codes of certain CalSTRS members and beneficiaries.

Immediately after learning of the exploit from PBI, CalSTRS initiated an investigation and worked to identify the members and beneficiaries whose information was involved.

CalSTRS is reviewing the relationship with PBI and is enhancing security measures related to the data we share with them. CalSTRS has implemented additional layers of security and account monitoring. Suspicious activity surrounding member accounts is investigated. CalSTRS continues to work to ensure that all of our service providers implement security measures that protect our members’ information.

CalSTRS initially offered one year of free credit monitoring to all three credit bureaus for members whose information was involved in this incident. This offer has been extended to two years of free credit monitoring. This includes:

• Daily credit reports available for online members.
• Monitoring: Actively monitors Experian, Equifax and Transunion files for indicators of fraud.
• Identity restoration: Identity restoration specialists are immediately available to help address credit and non-credit related fraud.
• Additional services outlined in the letter sent to affected members in June.

This event did not involve unauthorized access to the CalSTRS secure network. No member or beneficiary myCalSTRS accounts or financial information was involved in this incident.

Pension payments continue to be distributed on-time, as scheduled.

If you received a letter in June about the PBI data security incident with a CalSTRS logo on it, you may follow the instructions to sign up for complimentary credit monitoring online or through the toll-free number in the letter.

• This letter was sent by the vendor providing the complimentary credit monitoring service. The out-of-state return address on the letter is different than CalSTRS’ mailing address. If you have concerns about the authenticity of the letter, call CalSTRS at 800-228-5453.
• To sign up for complimentary credit monitoring online or over the phone, you will need the ‘engagement number’ (printed at the bottom of every page) and the unique activation code located near the top of page 2 of the letter.
• The toll-free number to sign up is operational seven days a week. Please understand call volumes are high and wait times are long.
• The deadline to sign up for complimentary credit monitoring is October 31, 2023.

Beginning in mid-September, CalSTRS is sending a second, follow up letter about the original data security incident involving PBI Research Services. This second letter will inform members that CalSTRS is offering an additional year of credit monitoring, as well as extending the deadline to sign up for a membership by one month to October 31, 2023. The free 24-month credit monitoring membership will only be available if you enroll by the October 31, 2023, deadline.

If your information was not involved in this incident, you don’t need to take any further steps.

The first letter sent in late June included a unique, single-use code which you will need to sign up. If you do not recall receiving a letter, or have lost it, please call CalSTRS at 800-228-5453 to verify your information and obtain the unique, single-use code you need to sign up for free credit monitoring.

You can call the number in your letter and enroll with an agent and get your alerts sent by mail.

You don’t need to do anything. 12 additional months of monitoring will be automatically added to your account after the sign-up period closes on October 31, 2023.

If you enrolled prior to receiving a second letter, 12 additional months will be automatically added to your account after the sign-up period closes on October 31, 2023. Your 24-month membership will be based on the date you signed up. Membership ends automatically after the 24-month term expires. You don’t need to take additional steps to cancel the membership.

For additional information on protecting your credit, visit the Federal Trade Commission’s Consumer Advice website.

There is no evidence that members have experienced identity theft because of this incident.

CalSTRS uses PBI to help administer benefit payments by validating the personal information of members and their beneficiaries, which helps to prevent payment errors. This service, which is permitted by law, allows CalSTRS to more timely identify members or beneficiaries who have passed away and protects benefit recipients from having to pay money back to CalSTRS after the loss of a loved one.

If you have additional questions about your pension, or other concerns that can’t be answered by the credit monitoring service, please contact CalSTRS at 800-228-5453.