TransUnion
bd_12f1bc01ded96f42 · schema v1 · pii pii-v1
Full breach record for TransUnion →11 incidents on fileThreat-actor claim — not a regulatory filing
This row is a claim by the ransomware group Shinyhunters on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Company description · AI-generated by the aggregator, not the leak post
TransUnion is a global credit reporting agency that provides credit information and analytics services to businesses and individual consumers. It collects and aggregates information on over a billion individual consumers in over thirty countries including "Big Three" credit-reporting agencies in the United States. The data they handle includes credit history, credit scoring, and personal information protection services.
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Jun 28, 2025
Claim posted
—
Corroborated · see linked filings
This record's own dates cannot anchor compliance clocks; see the linked filings.
Claim → filing
—
Compliance clock
Not assessable
Linked disclosures
Why this link?Regulatory filings (10) · sorted by filing gap
- California State AGbd_217b0e65bf1e48972025-08-27 · +60dVerified by operator
- Vermont State AGbd_82d4818cdee39c862025-09-01 · +65dVerified by operator
- Oregon State AGbd_5b59f10c6f6c553f2025-09-02 · +66dVerified
- Iowa State AGbd_fd85f6604075cd912025-09-02 · +66dVerified by operator
Show 6 more filings ↓Show fewer ↑up to 72d gap
- Montana State AGbd_9bac2141a674997f2025-09-03 · +67dVerified by operator
- New Hampshire State AGbd_331561e568edbb3f2025-09-04 · +68dVerified by operator
- Texas State AGbd_83b605646965217d2025-09-04 · +68dVerified by operator
- South Carolina State AGbd_d7d141dc595dd1b02025-09-04 · +68dVerified by operator
- Massachusetts State AGbd_d87eb450bda408862025-09-04 · +68dVerified by operator
- Nebraska State AGbd_aaa181287c2471442025-09-08 · +72dVerified by operator
Showing first 10 of 14 linked disclosures.
Filing propagation · 10 filings · 10 states
View merged incident ↗Pattern: first filing Aug 27 (CA), last Sep 8 (NE) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Cascade drawn from the first 10 linked disclosures of 14 — the full spread may be wider.
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
shinyhunters
According to ransomware.live, ShinyHunters is a financially motivated data-theft and extortion group active since 2020, responsible for high-profile breaches including Ticketmaster (via Snowflake) and PowerSchool; by 2025 they launched a RaaS offering called "shinysp1d3r," and in August 2025 French authorities arrested four members.