TransUnion Hit with Class Action Over Data Breach Affecting Approx. 200 Million U.S. Customers

New to ClassAction.org? Read our Newswire Disclaimer

TransUnion faces a proposed class action less than a month after the credit reporting agency disclosed that millions of customers’ files were accessed without authorization during a data breach. 

The 43-page complaint says that the personally identifiable information of approximately 200 million TransUnion customers nationwide was compromised in the incident, which the company reported to the Massachusetts attorney general on November 7. According to the suit, customers’ names, addresses, full Social Security numbers, financial account numbers and driver’s license information were exposed in the data breach. 

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here. 

The case charges that TransUnion has run afoul of the federal Fair Credit Reporting Act (FCRA) by failing to safeguard the consumer information with which it was entrusted as a credit reporting agency. Per the suit, the incident stemmed from TransUnion’s “reliance on an insecure information storage and transfer system that proved readily penetrable to nefarious hackers.” 

“Defendant knew that critical software was required to protect Plaintiff’s and Class members’ personal information,” the complaint reads. “Further, TransUnion prides itself on making ‘trust possible,’ and it knows that consumer trust is closely tied to, among other things, the way it safeguards and ‘stewards the information’ it collects, stores, maintains, and/or transfers. Yet, Defendant knew that sensitive consumer information uploaded to its proprietary database was susceptible to security risks. Nonetheless, Defendant continued to store, maintain, and transmit extremely sensitive [personally identifiable information] using this insecure software.” 

According to the lawsuit, TransUnion maintains information on one billion individuals worldwide, including more than 200 million in the United States alone. The filing stresses that the agency is “well aware” of the likelihood and repercussions of cybersecurity threats given the prevalence of numerous other well-publicized data breaches involving major corporations within the last decade. Just last year, the suit says, TransUnion spent $638 million to buy identity theft protection company Sontiq, purportedly to “bolster its data breach response and product offerings.” 

The case relays that TransUnion holds itself out as a “leader and expert” in anticipating and combatting data threats and sells products to consumers and businesses to prevent and address identity theft and fraud.

Despite its representations, TransUnion knew that the personal information stored on its database was “vulnerable and otherwise not secure,” the suit alleges. Accordingly, the company should have anticipated and taken appropriate steps to protect the data from cyberattacks, the lawsuit contends. 

In its notice to data breach victims, TransUnion stated that it is offering consumers complimentary identity theft protection and credit monitoring services for up to 42 months. 

The lawsuit looks to cover all consumers in the United States whose personally identifiable information was exposed in the TransUnion data breach announced in November 2022. 

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.