TransUnion Personal Data Exposed in Third-Party Support App Breach

A major data incident at TransUnion has exposed the personal details of over 4.4 million customers after a third‑party application used within the firm’s U. S. consumer support operations was infiltrated. TransUnion has asserted that no credit reports or core credit information were accessed during the breach.

The breach occurred on 28 July 2025 and was detected two days later, according to a filing with the state attorney general’s office in Maine. The compromised system is linked to a vendor-based support application, and while the company has described the affected data as “limited personal information,” the specific nature of the data remains unspecified. TransUnion emphasised that it did not include credit or financial details.

TransUnion is offering 24 months of complimentary identity‑theft protection and credit monitoring via its myTrueIdentity service to the affected customers. Cybersecurity experts have been engaged to conduct a forensics review and law enforcement agencies have also been notified.

This breach aligns with a spate of high‑profile intrusions that leveraged vulnerabilities in systems linked to Salesforce. Several notable firms, including Google, Allianz Life, Cisco, Workday, and Qantas, have recently disclosed breaches allegedly tied to data stored in Salesforce platforms and targeted by extortion groups such as ShinyHunters or UNC6395. Industry analysts view this structure as a growing attack vector.

TransUnion, headquartered in Chicago and one of the “Big Three” credit reporting agencies alongside Experian and Equifax, manages credit and risk data for hundreds of millions globally, including over 260 million adults in the U. S. Its dominance in the financial ecosystem makes it a significant target for cybercriminals.

This incident underscores a broader concern regarding the security of third‑party systems embedded within critical corporate infrastructure. Recent data indicates that third‑party breaches have become increasingly common—supply chain vulnerabilities have doubled between 2023 and 2024, according to cybersecurity surveys.

Affected consumers should stay alert to suspicious communications or fraud attempts, even as they take advantage of the credit monitoring provided. TransUnion has stated that it continues to enhance its security protocols to reduce the likelihood of similar events.