Over 4.4 Million Affected in TransUnion Data Breach

A recent breach into credit reporting giant TransUnion has exposed the information of 4,461,511 US customers, as reported in an August 26 filing in the state of Maine (US). Though TransUnion denies the theft of any credit card information, other personally identifiable information (PII) was accessed.

“We are writing to make you aware of a cyber incident involving unauthorized access to some of your personal data that was stored on a third-party application. Importantly, no credit information was accessed. We are providing details about the incident and about resources we are providing to assist you,” reads a letter reportedly sent to affected customers.

TransUnion is one of the largest credit reporting companies in the US, with access to the financial information of over 260 million US citizens.

“We identified and contained this event within hours,” a TransUnion spokesperson told media outlets.

The hack reportedly occurred on July 28 and was discovered on July 30. A different legal document filed by the company shows that while TransUnion says no credit card data was stolen, other valuable personally identifiable information (PII), such as full names, Social Security numbers, and birthdates, was compromised. This information can be used by malicious actors for identity theft, blackmail, or ransom demands.

In its letter, TransUnion offered free credit monitoring and “proactive” fraud assistance for 24 months to affected customers. “TransUnion takes the protection of personal information seriously […] We continue to enhance our security controls as appropriate to minimize the risk of any similar incident in the future,” the letter continues.

Though the third-party company that was allegedly subject to the initial breach was not named, TransUnion joins a slew of other high-profile US companies that have recently experienced data breaches, including Google, Cisco, and most recently, the HR platform Workday.

Those incidents reportedly stemmed from a breach in Salesforce’s customer relationship management platform, though there is no confirmed link between those breaches and the TransUnion incident.

So far, no information has been released regarding the hacker(s) identity, motives, or demands.