TransUnion data breach (2025): 4.4 million people exposed through a third-party support app
A credit bureau holds data on most US adults, so a TransUnion breach is a breach of people who never chose to be its customers. This page is the running record of TransUnion’s documented incidents: the 2025 US consumer-support breach and the 2022 South African server compromise, each with its filing or company statement.
Short answer
Was TransUnion hacked?
Yes. TransUnion told Maine’s Attorney General on 28 August 2025 that an unauthorised party accessed a third-party application used by its US consumer support operations on 28 July 2025, affecting more than 4.4 million people. It found the access on 30 July.
A separate Texas filing listed names, dates of birth and Social Security numbers among the data. TransUnion said no credit information was accessed. It has not named the application; reporting places the breach in the 2025 wave of Salesforce-connected data thefts, but TransUnion has not confirmed who was behind it. In 2022, TransUnion South Africa separately confirmed that a criminal had accessed one of its servers using a client’s credentials.
Timeline at a glance
17 Mar 2022TransUnion South Africa confirms a server was accessed with a client’s misused credentials; ransom refused. (CyberScoop)Confirmed
28 Jul 2025Unauthorised access to a third-party app used by US consumer support. (Maine AG via TechCrunch)Confirmed
28 Aug 2025Maine and Texas filings: 4.4M+ people; names, birth dates, SSNs. “No credit information was accessed.” (TechCrunch)Confirmed
2025Linked in reporting to the Salesforce-targeting extortion wave; attribution not confirmed by TransUnion. (FBI FLASH (campaign))Reported
Last updated October 30, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
TransUnion incident timeline, in detail
Confirmed = acknowledged by TransUnion, a regulator filing or a court. Reported = credible reporting TransUnion has not fully confirmed. Unverified claim = an attacker or leak-site claim.
28 Jul 2025ConfirmedThird-party / SaaS
Third-party consumer-support application breached; more than 4.4 million people notified
What happened. TransUnion’s filing with the Maine Attorney General says an unauthorised party accessed a third-party application that stores personal data for its US consumer support operations on 28 July 2025, and that it discovered the access on 30 July. The Maine notice did not list data types; a separate Texas filing listed names, dates of birth and Social Security numbers. TransUnion said “no credit information was accessed” and declined to name the application or answer further questions.
Impact. More than 4.4 million people notified. Social Security numbers plus dates of birth are the core ingredients for identity fraud, which is why the breach matters despite the credit file itself being untouched.
Reported as part of the Salesforce-connected data-theft wave
What happened. TechCrunch placed the breach in a run of 2025 thefts from Salesforce-hosted databases at companies including Google, Allianz Life, Cisco and Workday, which Google attributed to the ShinyHunters extortion group. The FBI’s September 2025 FLASH describes two groups (UNC6040 and UNC6395) stealing data from organisations’ Salesforce instances by voice phishing and stolen OAuth tokens. TransUnion has not said its application was Salesforce or who was responsible.
Impact. If the link holds, the root cause is the customer-side SaaS tenant and its connected apps, not a flaw in the vendor platform. The attribution remains reporting, not a TransUnion statement.
TransUnion South Africa server accessed with a client’s credentials
What happened. TransUnion South Africa confirmed that a “criminal third party” accessed one of its servers through “misuse of an authorised client’s credentials”, said the incident affected “an isolated server holding limited data from our South African business”, and said a ransom demand would not be paid. A group calling itself N4aughtySecTU claimed over 4TB of data and demanded about $15 million; those claims were not verified.
Impact. Limited data per TransUnion; attacker volume claims unverified.
Data types: the Maine filing listed none; the Texas filing listed names, dates of birth and SSNs. TransUnion said no credit information was accessed but did not publish evidence for that.
Who did it: reporting links the breach to the ShinyHunters/Salesforce wave, while other outlets say attribution is unclear. TransUnion has not named the attacker or the application.
South Africa 2022: the attackers claimed more than 4TB; TransUnion said a single isolated server with limited data was affected.
The pattern across the record
Both incidents came in through someone else’s access
In 2022 it was a client’s login; in 2025 it was a third-party support application. Neither was a break-in to the core credit database, and both still exposed people’s identity data.
Support tooling holds the most sensitive copy of the data
Consumer-support platforms need names, dates of birth and SSNs to verify callers, so they hold the fraud-ready subset of a bureau’s data with fewer controls than the core system.
What it means for TransUnion customers and data subjects — and what to do
You do not need to be a TransUnion customer to be affected: the bureau holds files on most US adults. If you received a notice, or simply want to be safe, the steps are cheap and quick.
1.Freeze your credit at all three bureaus
A freeze is free in the US and stops new accounts being opened in your name. Lift it temporarily when you apply for credit.
2.Use the monitoring offered, but do not rely on it
Monitoring tells you after something happens; a freeze prevents it. Use both if you were notified.
3.Expect convincing phishing
With your name, date of birth and SSN, a scammer can pass basic identity checks. Do not confirm details to inbound callers who claim to be a bureau or bank.
4.For businesses: audit connected apps on your CRM and support stack
Review which third-party apps hold OAuth access to your Salesforce or support tenant, remove stale ones, and restrict API exports.
Yes. TransUnion told regulators that on 28 July 2025 an unauthorised party accessed a third-party application used by its US consumer support operations, affecting more than 4.4 million people. In 2022 TransUnion South Africa separately confirmed a server was accessed using a client’s credentials.
What data was taken in the TransUnion data breach?+
TransUnion’s Texas filing listed names, dates of birth and Social Security numbers. TransUnion said no credit information was accessed. The Maine filing did not list data types.
How many people were affected by the TransUnion breach?+
More than 4.4 million, per TransUnion’s filing with Maine’s Attorney General on 28 August 2025.
Was the TransUnion breach part of the Salesforce hacks?+
Reporting places it in the 2025 wave of thefts from Salesforce-connected systems linked to ShinyHunters, but TransUnion has not named the application or the attacker, so treat the link as reported, not confirmed.
What should I do if I got a TransUnion breach letter?+
Freeze your credit at Equifax, Experian and TransUnion (free in the US), enrol in the monitoring offered, and be wary of calls or emails that use your personal details to sound legitimate.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by TransUnion. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout