TransUnion notifying more than 4.4 U.S. million consumers of data breach

TransUnion has notified the Maine Attorney General’s Office that 4,461,511 U.S. persons were affected by an incident on 28 July 2025 involving an unnamed third-party application, with the breach discovered on 30 July 2025. The notification letter provided to Maine is light on details about when the breach occurred, how it happened, or what the third-party application was, and it does not mention any ransom demand or threat.

The letter does, however, state that the data involved was limited to specific data elements and did not include credit reports or core credit information, and that the affected individuals comprise U.S. consumers out of roughly 200 million such records that TransUnion compiles. TransUnion is offering those affected 24 months of credit monitoring and proactive fraud assistance to help with questions now or in the future.

DataBreaches[.]Net notes an update in which ShinyHunters described the wider impact claims as consistent with other background information, including a global figure of 13 million+ records.