HackingFinancial ServicesFinanceSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedPIIMediumContained
TransUnion
bd_9d7ad1a3ef9bd9ae · schema v1 · pii pii-v1
Full breach record for TransUnion →TransUnion LLC reported a cyber incident occurring on July 28, 2025, discovered July 30, 2025, involving unauthorized access to personal data stored on a third-party application supporting U.S. consumer operations. No credit reports or core credit information was accessed. Approximately 4,461,511 individuals were affected nationally, including 16,828 Maine residents. Consumers were notified August 26, 2025 and offered 24-month credit monitoring via myTrueIdentity.
Leak gap clock⏱ Leak >30d28 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 4 about the same incident.View merged incident
A leak claim by shinyhunters about this victim predates this filing by 60 days.View originating leak claim
Linked disclosures
Why this link?Ransomware claims (1)
- bd_12f1bc01ded96f42Leak Siteshinyhuntersfiled 2025-06-28(60d gap)Verified
Regulatory filings (2) · sorted by filing gap
- bd_217b0e65bf1e4897California State AGfiled 2025-08-27Verified
- bd_085cfd4342522886Indiana State AGfiled 2025-08-26(1d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/3dcd9b7c-bce3-4685-bffd-f728ce96e2fd.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 27, 2025
- Raw hash
- cf9f549b0dca132d96f672d979030bec3f39f6a09ba22ef8fe2fbf646d07d13f
Reporting entity
- Name
- TransUnionnorm: transunion
- Domain
- transunion.com
- Industry
- Other Commercial
Victim entity
- Name
- TransUnionnorm: transunion
- Domain
- transunion.com
- Industry
- Other Commercial
- Industry
- Financial Servicesllm
Incident
- Discovered
- Jul 30, 2025
- Materiality determined
- —
- Notification sent
- Aug 26, 2025
- Affected individuals
- 16,828
- Data types
- PII
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Regulator citations
- Notified Maine Attorney General
Compliance
- Time to disclose
- 28 days(28 days from discovery to filing)
- Compliance flags
- Leak >30dME AG ≤30d · 28d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Jul 30, 2025→ Filed with AG: Aug 27, 202528d 30 days ME AG ≤30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.