Data breach at TransUnion impacts 4.4 million people

Editor’s note: This story was updated at 10:00 a.m. EST with comment from TransUnion.

Nearly 4.5 million people were affected by a data breach at the credit reporting giant TransUnion, the company informed regulators this week.

According to a sample letter notifying victims of the breach, a cyber incident “involving a third-party application” used for customer support resulted in unauthorized access to “limited” personal information. No credit information was accessed and the breach “did not involve our core credit database,” the company said.

The incident occurred on July 28 and according to TransUnion was contained "within hours." A regulatory filing in Texas shows that Social Security numbers were among the leaked information. 

“The incident involved unauthorized access to limited personal information for a very small percentage of U.S. consumers. We are working with law enforcement and have engaged third party cyber security experts for an independent forensics review,” TransUnion said in a statement. 

The breach is the latest to target companies that hold huge amounts of data on people around the world. The insurance companies Allianz Life and Farmers Insurance were both recent victims of third-party breaches that are reportedly linked to social engineering attacks on Salesforce.   

The Google-owned firm Mandiant issued an advisory about the Salesforce attacks earlier this week, calling it a “widespread data theft campaign” and attributing it to the threat actor UNC6395. The hackers targeted OAuth tokens associated with the Salesloft Drift third-party application, Mandiant said.  

TransUnion did not say which third-party vendor was impacted. The company claims to have a database of credit histories on more than 260 million Americans.