This report describes an incident where a USAA customer mistakenly used an incorrect email address when signing up, resulting in sensitive account-related emails being sent to a third party with a similar but different email address. The unintended recipient repeatedly notified USAA about the issue, but the problem remained unresolved for months. The exposed information includes account notifications and beneficiary changes, though no account numbers or direct access were disclosed. There is no indication of active exploitation or compromise beyond the misdirected emails.

Sensitive account notifications and changes are disclosed to an unintended recipient due to an email address typo during signup. This may lead to privacy violations and potential information leakage. However, no direct account compromise or financial loss is reported. The affected party is unable to stop the information leakage despite notifying the vendor multiple times.

Patch status is not applicable as this is a procedural or operational issue rather than a software vulnerability. The vendor (USAA) should investigate and correct the email address associated with the affected account to stop further misdirected communications. Users should verify their contact information carefully during signup. No further mitigation actions are indicated from the report.