TransUnion

In July 2025 attackers got into a third-party application used by TransUnion's own U.S. consumer-support operation. They took names, Social Security numbers and birth dates of 4,461,511 people, according to TransUnion's filing with the Maine AG. That was the credit bureau's own breach, not a breach of a lender's data. It follows a long run of FCRA enforcement. In 2023 the CFPB found TransUnion took years to place security freezes and falsely told consumers their freezes were in place, resulting in an $8M order that was terminated in Nov. 2025. Its rental-screening unit paid $15M to the CFPB and FTC over inaccurate eviction records in tenant screening reports.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-10-16

Primary source. www.consumerfinance.gov/enforcement/actions/transunion-trans-union-llc-and-transunion-interactive-inc/ — Unverified - heuristic first draft.

Arbitration

Site Terms of Use: NO arbitration clause or class waiver. Disputes go to state and federal courts in Cook County, IL under Illinois law (footer 'Revised as of March 11, 2019'). Paid consumer products are governed by a separate TransUnion Interactive service agreement, which was not retrieved this pass, so arbitration terms for consumer products are not verified.

Data sharing

SELLS DATA, INCLUDING SENSITIVE DATA: the privacy notice (effective July 1, 2026) states 'NOTICE: We may sell your sensitive personal data' and that TransUnion 'may share your personal information for a targeted advertising purpose'. It also says customers who buy data may use it to customize large language models for internal purposes. Collected categories include biometric information (audio recordings, facial imaging), geolocation and inferences. TransUnion identifies itself as a data broker under Texas law. JULY 2025 BREACH: 4,461,511 people; names, SSNs, and dates of birth. The attackers additionally claim addresses, emails and phone numbers, which TransUnion has not confirmed. Opt-outs: service.transunion.com/dss/ccpa_optout.page and the cookie settings page.

Contacts

Privacy contact. TransUnion Data Privacy, P.O. Box 130, Woodlyn, PA 19094; privacy@transunion.com; 1-866-310-8783

Legal notice. TransUnion, 555 West Adams Street, Chicago, IL 60661 (SEC 10-K cover / EDGAR). The registered agent was not verified this pass.

Mailing address. Not recorded.