1st September 2025 Cyber Update: TransUnion Discloses Breach Affecting 4.4 Million Customers

The Update: TransUnion has confirmed a data breach that exposed the personal information of 4.4 million customers. The incident, which occurred on July 28, 2025, resulted from unauthorized access to a third-party application used for the company's U.S. consumer support operations. According to disclosures filed with the attorney general's offices in Maine and Texas, the compromised data includes customer names, dates of birth, and Social Security numbers.

TransUnion has stated that its core credit database was not affected and that no credit information was accessed during the breach. The company has begun notifying affected individuals and is offering two years of free credit monitoring services through Cyberscout. While the specific third-party application has not been named, the incident is part of a broader trend of attacks targeting corporate systems through their supply chain and third-party vendors. TransUnion has said it "quickly contained the issue" but has not yet disclosed who was behind the attack.

Why it Matters: This breach at a major credit reporting agency highlights the significant downstream risk posed by third-party applications. Even though TransUnion's core credit databases were not compromised, the theft of sensitive personal information like Social Security numbers provides criminals with the primary tools needed for identity theft and sophisticated phishing campaigns.

For the 4.4 million individuals affected, the risk of fraud is now substantially higher. This incident also reinforces the importance of supply chain security, demonstrating that even large corporations with extensive security resources remain vulnerable through their interconnected software and service providers. The breach serves as a critical reminder for organizations to rigorously vet and monitor the security posture of all third-party applications with access to sensitive data.