The breach occurred July 28, 2025

-
TransUnion says more than 4.4 million peoples personal data was exposed after hackers accessed a third-party app used for U.S. consumer support.
-
The breach occurred on July 28 and was detected on July 30; exposed data includes names, dates of birth, and Social Security numbers, according to state filings.
-
Reporting links the theft to a broader wave of attacks targeting companies Salesforce environments, though TransUnion hasnt named the vendor.
Credit reporting giant TransUnion has begun notifying more than 4.4 million people that their personal information was compromised last month. The company said the cyber incident was tied to a third-party application used for its U.S. consumer support operations.
In state filings and statements, TransUnion said the intrusion occurred on July 28, 2025, and was discovered two days later. The company emphasized that no credit reports or core credit information were accessed.
A subsequent filing clarified that the exposed data includes names, dates of birth, and Social Security numbers elements that enable identity theft even without credit files. The company is offering affected individuals 24 months of free credit monitoring and fraud assistance.
While TransUnion did not identify the third-party platform, security researchers and reporters say the breach appears connected to a broader campaign in which threat actors exfiltrated data from organizations Salesforce instances. BleepingComputer, citing multiple sources including the ShinyHunters extortion group, reported that TransUnions stolen dataset was taken from its Salesforce account; SecurityWeek noted the possible Salesforce link and that similar attacks have hit other major brands this year. TransUnion has not confirmed those details.
Regulators were notified via the Office of the Maine Attorney General, a common venue for disclosure because it publishes breach notices publicly. TransUnion told Maine authorities that 4,461,511 individuals were impacted.
TechCrunch first reported the Maine and Texas filings and noted that the data elements include Social Security numbers.
The incident underscores the risk concentration in customer-support and CRM systems that store sensitive identifiers alongside service tickets and contact information. Recent advisories have warned of voice-phishing and session-hijacking campaigns aimed at cloud-hosted business apps, which can bypass traditional perimeter defenses once access is obtained.
What to do
Authorities say consumers should:
-
Place a free freeze with TransUnion, Equifax, and Experian to block new credit lines; you can lift it temporarily when needed.
-
Add a fraud alert if you dont want a full freeze; it requires lenders to take extra steps to verify your identity.
-
Enroll in the offered monitoring and set account alerts for new applications, address changes, and hard inquiries.
-
Watch your mail and email for phishing attempts referencing the breach, and use unique passwords plus a password manager.
Posted: 2025-08-29 13:42:09