TransUnion Data Breach Hits 4.4 Million Customers

TransUnion said a third-party data breach affected more than 4.4 million customers.

The credit reporting agency revealed the breach in a filing with the Maine’s attorney general’s office on Thursday (Aug. 28). The company said the breach on July 28 involved unauthorized access of a third-party application that contained customers’ personal data for its U.S. consumer support operations. The incident was discovered July 30.

“The information was limited to specific data elements and did not include credit reports or core credit information,” the company wrote, but did not specify what types of data were involved.

A report on the breach by TechCrunch said a company spokesperson declined to answer questions about the company’s data breach, or reveal what types of customers’ personally identifiable information were stolen.

However, the same report noted that in a separate data breach disclosure filed Thursday with Texas’ attorney general’s office, TransUnion said that the stolen personal information included customers’ names, birthdates and Social Security numbers.

The breach follows a series of cybersecurity incidents at big companies involving third-party vendors. For example, firms such as Google, Cisco and Workday have also seen thefts of customer data kept on Salesforce’s cloud recently.

As PYMNTS noted in a report earlier this week, events like this are “a stark reminder of a hard truth: sometimes, the weakest link in a company’s cybersecurity defenses isn’t the company itself, but a trusted vendor.”

Data from PYMNTS Intelligence in the August edition of The 2025 Certainty Project report, “Vendors and Vulnerabilities: The Cyberattack Squeeze on Mid-Market Firms” reveals that for mid-market firms, this presents both a structural challenge and a strategic paradox.

“These firms depend on vendors for efficiency, innovation and scale, yet that very reliance multiplies their attack surface,” PYMNTS wrote. “Frequently, attackers compromise a vendor first, then use the trust relationship to infiltrate their target firm. This creates what cybersecurity analysts call the vendor vulnerability paradox: the more deeply firms integrate third-party partners, the more exposed they become.”

Attackers recognize how vulnerable these companies can be, and “play the long game,” the report added, targeting a single vendor instead of attacking dozens of mid-sized companies. The research found that 38% of fake invoice scams stemmed from vendor or supplier compromise, while 43% of phishing incidents were tied to third-party breaches.

“What makes these attacks effective isn’t sophisticated code but basic psychology,” PYMNTS wrote. “Cybercriminals exploit trust, urgency and authority to trick employees into authorizing payments or disclosing credentials. As artificial intelligence tools make phishing emails more convincing and deepfake audio more accessible, the manipulation is becoming harder to detect.”

The post TransUnion Data Breach Hits 4.4 Million Customers appeared first on PYMNTS.com.