TransUnion data breach 2025: what happened and what to do

TransUnion, one of the three major US credit bureaus, disclosed in late August 2025 that a cyberattack had exposed personal information of more than 4.4 million people. The state filings date the incident to July 28, 2025, and say it was found two days later.

What happened

TransUnion said attackers gained unauthorized access to a third-party application behind its US consumer support operations. The company didn't name the vendor. Some press coverage tied the incident to a wider run of attacks on Salesforce customer data, but TransUnion has not confirmed that link, and Salesforce declined to comment on specific customers. Treat the vendor and method as unconfirmed.

TransUnion told regulators it notified affected people and offered 24 months of free credit monitoring through its myTrueIdentity service. In its statement, the company said that no credit reports or core credit information were accessed.

What was exposed

The first notices didn't spell out the data types. Later filings reported by SecurityWeek and other outlets list names, dates of birth and Social Security numbers. TransUnion's own statement says credit reports were not accessed. Washington's Attorney General lists a count for residents of that state only, so the 4.4 million figure is the company's national number, not the sum of the state lists.

Why a bureau breach still matters

A credit bureau holds the details lenders use to decide who you are. Even though TransUnion says credit files weren't touched, a name, birth date and Social Security number together are enough to attempt identity theft: opening accounts, filing false tax returns or taking over existing accounts. They also give scammers an opening for convincing phone calls and letters. People who get a breach notice from a credit bureau are prime targets for fake follow-ups, such as a call offering to "help you secure your credit file." A real notice never asks you to read out your full Social Security number or pay a fee to be protected. If a message does, it's a scam, and the right move is to hang up and use the contact details printed on your letter.

Freeze first

The standard advice after a breach like this is to freeze your credit at the three bureaus, including TransUnion. That's still correct. A freeze is free, doesn't affect your credit score and blocks most new-account fraud even if someone has your Social Security number.

What to do if you got a letter

Use the free monitoring if you want it, but don't treat it as a substitute for a freeze. Monitoring tells you after something has happened. A freeze stops most of it from happening. Keep the letter, note the date you received it and put a reminder in your calendar to check your credit reports every few months for the next two years.