TransUnion breach affects more than 4.4 million via third-party app

TransUnion disclosed that a cyber incident on July 28 exposed personal information belonging to more than 4.4 million U.S. customers, according to a notification filed with the Maine attorney general. The credit reporting company said the breach involved unauthorized access to a third party application used by its U.S. consumer support operations and was discovered two days later on July 30.

In a sample notification included in the filing, TransUnion told affected consumers, "We recently experienced a cyber incident involving a third party application serving our U.S. consumer support operations." The company added that "the unauthorized access includes some limited personal information belonging to you," but did not specify in the notice which specific data elements were exposed. TransUnion has maintained that the breach did not involve its core credit database and that credit reports or core credit information were not accessed, a claim the company has not publicly detailed with technical evidence.

The company said it quickly contained the issue, is working with law enforcement and independent forensic experts, and is notifying those impacted. TransUnion is offering 24 months...