TransUnion says 4.4 million customers affected by third-party breach

TransUnion has informed more than 4.4 million U.S. customers of a third-party data breach affecting their personal data.

The credit reporting agency notified affected consumers in a letter Tuesday that unauthorized access was made to data “stored on a third-party application,” according to a recent filing to the Office of the Maine Attorney General.

Another filing, made Thursday to the Attorney General of Texas, revealed that affected data types included names, Social Security numbers and dates of birth. TransUnion noted that no credit information or credit reports were compromised.

The breach reportedly occurred on July 28, 2025, and was discovered on July 30, according to the Maine filing. TransUnion said the breach affected a third party “serving our U.S. consumer support operations.”

The threat group ShinyHunters told BleepingComputer that they were behind the attack and that the breach was part of ShinyHunters’ infiltration of Salesforce environments.

TransUnion is offering affected customers 24 free months of credit monitoring through its Cyberscout fraud assistance and remediation subsidiary.

“TransUnion takes the protection of personal information seriously, which is why we engage in robust, proactive security measures. We continue to enhance our security controls as appropriate to minimize the risk of any similar incident in the future,” the notification letter stated.

TransUnion Canada previously faced a cyber incident in 2019, when stolen credentials were used to access a web portal and look up consumer information including names, dates of birth, addresses, information related to credit and loan obligations and cred re-payment history.

More recently, in September 2023, TransUnion refuted claims by the threat actor USDoD that sensitive data from nearly 59,000 consumers was stolen from company systems, stating several aspects of the supposed leaked database “do not match the data content or formats at TransUnion, indicating that any such data came from a third party.”