TransUnion Credit Bureau Breach (Salesforce, 2025): 13 Million Customer Records Including SSN & Home Address Exposed

About Transunion

TransUnion is one of the three major U.S. consumer credit reporting bureaus, collecting and maintaining credit histories on hundreds of millions of individuals globally. The company is publicly traded on the NYSE and headquartered in Chicago. Beyond credit reporting, it provides fraud detection, identity verification, marketing analytics, and risk management services to financial institutions, insurers, and employers in more than 30 countries.

Why They Hold Your Data

Credit reporting agencies aggregate identity, credit, financial, and behavioral data across individuals, including credit scores, account histories, addresses, and employment-related information.

Recent Developments

TransUnion has continued expanding its international data and analytics footprint, with particular focus on financial services risk products and identity verification. The company has been investing in AI-driven fraud detection capabilities. It has also faced scrutiny from consumer advocates over data accuracy and access practices under the Fair Credit Reporting Act. The 2025 Salesforce campaign was the most significant data security event of the period.

Data Points Exposed

Breach Impact

TransUnion was among the approximately 39 organizations listed on the Scattered LAPSUS$ Hunters dark web leak site in October 2025. The exposed records included names, email addresses, phone numbers, home addresses, and Social Security numbers — a particularly sensitive combination given TransUnion's identity as a credit bureau whose data sits at the center of identity theft risk frameworks. The irony of a credit bureau being listed in a mass identity data exposure was noted widely in security reporting. TransUnion has not made detailed public statements about the specific scope of its exposure in this campaign. Salesforce attributed the campaign to customer-side integration vulnerabilities rather than a core platform compromise.

Exploitation & Downstream Threats

• Identity theft and synthetic identity construction using government-issued IDs | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure

What You Should Do

1. Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
2. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
3. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
4. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).