TransUnion, one of the three major U.S. consumer credit reporting bureaus, was listed among approximately 39 organizations targeted by a group calling itself "Scattered LAPSUS$ Hunters" in October 2025. The attackers accessed data through a supply chain pathway linked to Salesforce, which attributed the campaign to customer-side integration vulnerabilities rather than a compromise of its core platform. On October 3, 2025, the group published a sample of the stolen database, with the full dataset of 13.1 million records reportedly scheduled for release on October 10, 2025. The exposed data includes full names, email addresses, phone numbers, home addresses, and Social Security numbers, though SSNs appear in roughly 1% of sampled records. The breach also exposed customer account details, support chat transcripts, IP addresses, and authentication status flags. Because TransUnion operates at the center of the U.S. credit and identity verification system, this combination of data is particularly dangerous. Criminals can use it to open fraudulent accounts, bypass identity checks, and cause lasting damage to victims' credit profiles. TransUnion has not issued detailed public statements about the specific scope of its exposure in this campaign. No regulatory actions or formal notifications have been publicly confirmed as of the time of this report. Affected individuals face a severe and persistent risk of identity theft and financial fraud. Anyone who believes they may be affected should consider placing a credit freeze with all three major bureaus, monitoring their credit reports closely, and watching for signs of account takeover or unauthorized financial activity.

Credit reporting agencies aggregate identity, credit, financial, and behavioral data across individuals, including credit scores, account histories, addresses, and employment-related information.

TransUnion has continued expanding its international data and analytics footprint, with particular focus on financial services risk products and identity verification. The company has been investing in AI-driven fraud detection capabilities. It has also faced scrutiny from consumer advocates over data accuracy and access practices under the Fair Credit Reporting Act. The 2025 Salesforce campaign was the most significant data security event of the period.