People search TransUnion data breach timeline because the brand sits on billions of accounts, credentials, and cloud workloads. BreachHistory indexes 6 TransUnion-linked incidents, with headline counts up to 54M+ in catalog rows. This page maps every attested event through 2026 with internal links to canonical records.
Why TransUnion breach history matters
TransUnion operates in Finance (United States). Across indexed rows, recurring themes include credential theft and social engineering, third-party and supply-chain exposure, zero-day exploitation and malware. Understanding the chronological pattern helps security teams, customers, and regulators separate confirmed disclosures from forum marketing.
Full timeline through 2026
2025 — 4.5M consumers
Cataloged incident. Attackers exploited vulnerabilities in a Salesforce-connected third-party application used in TransUnion's consumer support operations. Unauthorized access July 28, detected July 30; contained within hours. Core credit databases and credit reports were not accessed. ShinyHunters and UNC6395 probed OAuth tokens and app integrations. Exposed categories include Names, dates of birth, email, mailing addresses, phone numbers, unredacted SSNs, customer support ticket notes. BreachHistory cites approximately 4.5M+ affected records in this row. See the transunion2025 and canonical BreachHistory entry.
2022 — 54M (stolen credentials)
Cataloged incident. N4ughtysecTU breached TransUnion South Africa using stolen credentials (password 'password'). 54M customer records; ransom demanded. South African subsidiary. Exposed categories include Customer records. BreachHistory cites approximately 54M+ affected records in this row. See the transunion-south-africa2022 and canonical BreachHistory entry.
2012 — — TransUnion: An unauthorized access occurred sometime between…
Cataloged incident. An unauthorized access occurred sometime between January 22 and February 15, 2012. Trans Union learned of the breach through its subscriber The Manufacturers Life Insurance Company (Manulife). Consumers may have had their credit reports accessed by someone using a client's login credentials. Names, Social Security numbers, and addresses would have been exposed. Exposed categories include Personal information. BreachHistory cites approximately 461 affected records in this row. See the transunion2012 and canonical BreachHistory entry.
2008 — — TransUnion: Credit profiles of as many as 400 Americans have…
Cataloged incident. Credit profiles of as many as 400 Americans have been altered by two employees of Mumbai, India-based Intelenet Global Services, an outsourcing company. The two arrested Intelenet employees had been accessing and altering data of individuals in the datafiles of the credit bureau TransUnion since August 2005. The bank account statements of the two men revealed that money was being deposited from an international source for the past few months. Exposed categories include Personal information. BreachHistory cites approximately 400 affected records in this row. See the transunion2008 and canonical BreachHistory entry.
2006 — — TransUnion: Four different scam companies downloaded the credit…
Cataloged incident. Four different scam companies downloaded the credit information of more than 1,700 individuals, including their credit histories and SSNs. They were able to illegitimately obtain the password to the TransUnion account held by the Kingman, AZ, court office, which apparently has a subscription to the bureau's services. Exposed categories include Personal information. BreachHistory cites approximately 2K+ affected records in this row. See the transunion2006 and canonical BreachHistory entry.
2005 — — TransUnion: A desktop containing Social Security numbers and…
Cataloged incident. A desktop containing Social Security numbers and other information was stolen from a regional sales office in California. Affected consumers were notified and offered one year of free credit monitoring services. Exposed categories include Personal information. BreachHistory cites approximately 4K+ affected records in this row. See the transunion2005 and canonical BreachHistory entry.
Patterns and analysis
- Credential theft and social engineering — appears across multiple TransUnion catalog entries; prioritize controls that address this class of failure.
- Third-party and supply-chain exposure — appears across multiple TransUnion catalog entries; prioritize controls that address this class of failure.
- Zero-day exploitation and malware — appears across multiple TransUnion catalog entries; prioritize controls that address this class of failure.
- Record-count hygiene — BreachHistory indexes actor-cited figures separately from company-confirmed totals; read each row's technicalWriteup before treating counts as fact.
- 2026 monitoring — New disclosures roll into this timeline as they are verified or labeled unverified per catalog policy.
What to do if you may be affected
- Step 1: Enable phishing-resistant MFA on every account tied to this brand.
- Step 2: Use unique passwords and a password manager—breach rows often involve credential reuse.
- Step 3: Monitor official company breach notices and regulator filings, not dark-web downloads.
- Step 4: Bookmark the TransUnion company page for new 2026+ disclosures.
Canonical BreachHistory hub
Explore every indexed row: breachhistory.com/transunion · Latest: transunion2025.
Sources: BreachHistory catalog (6 rows for TransUnion), company and regulator disclosures cited in individual breach records.