TransUnion Data Breach 2025: 4.4 Million Consumers, Stolen SSNs, and the Salesforce App TransUnion Didn't Control

On July 28, 2025, one of the three major US credit bureaus had the data of 4.4 million Americans stolen, and the breach did not touch a single TransUnion server that TransUnion fully controlled. The attackers came in through a third-party application connected to TransUnion's Salesforce environment, the Salesloft Drift integration, using stolen OAuth tokens and social engineering rather than any exploit of TransUnion or Salesforce themselves. The exposed data included names, dates of birth, billing addresses, phone numbers, and unredacted Social Security numbers. TransUnion described the exposure as limited personal information for a very small percentage of US consumers. Four and a half million people with their Social Security numbers in a criminal's hands is a strange definition of limited.

According to TransUnion's filing with the Maine Attorney General, the incident occurred on July 28, 2025 and affected 4,461,511 US consumers. The company said it identified and contained the event within hours and formally set a discovery date of July 30. The attackers, an affiliate cluster tied to ShinyHunters and tracked by some researchers as UNC6395, claimed roughly 13 million records in total.

The access path was not TransUnion's core systems. It was a third-party application, Salesloft Drift, integrated with TransUnion's Salesforce environment for customer-support operations. The attackers obtained valid OAuth tokens for that integration and used them to pull data from the connected Salesforce instance. TransUnion has stressed that its core credit database and credit reports were not compromised, and Salesforce has stated its own platform was not breached. Both can be true while 4.4 million consumers still lose their Social Security numbers, because the weakness lived in the connection between trusted systems, not inside any one of them.

The exposed data included names, dates of birth, Social Security numbers, billing addresses, email addresses, phone numbers, and customer-support records. TransUnion offered affected consumers 24 months of credit monitoring and identity-theft protection.

The TransUnion breach is one node in the largest third-party campaign of 2025: a coordinated assault on the Salesloft Drift integration that touched roughly 760 companies connected to Salesforce. The mechanics are the now-familiar logged-in pattern. Attackers compromised OAuth tokens for the Drift application, then used those tokens to authenticate to each victim's connected Salesforce instance and exfiltrate data. No password was cracked. No firewall was defeated. The application was trusted, so the access looked legitimate.

This is the same class of attack behind the wider ShinyHunters wave, including the Snowflake customer campaign a year earlier. It is also the precise mechanism described in our explainer on credential harvesting: steal the token, skip the login alert, and walk out with the data. When negotiations with Salesforce failed, the attackers stood up a leak site naming dozens of the breached companies, turning a quiet token theft into a public extortion campaign.

For sponsors, the lesson is that a portfolio company's security posture is only as strong as the third-party integrations no one is auditing. A SaaS-dependent business can have a hardened core and still lose its most sensitive data through a marketing or support app connected to its CRM. Quality-of-earnings work catches revenue concentration; it rarely catches integration concentration.

Diligence should enumerate every OAuth connection and SaaS integration touching customer data at the target, and treat them as part of the data-protection review rather than an IT detail. The question to ask is direct: which third-party apps can read our customer data, who controls them, and what happens when one of their tokens is stolen? See cyber due diligence.