TransUnion reckons big dump of stolen customer data came from someone else

Prolific info-thief strikes again

Updated Days after a miscreant boasted leaking a 3GB-plus database from TransUnion containing financial information on 58,505 people, the credit-checking agency has claimed the info was actually swiped from a third party.

On Sunday, a thief using the handle USDoD shared via a cyber-crime forum what was claimed to be a TransUnion database containing sensitive information belonging to people in North and South America, Europe, and other parts of the world. This database is said to include people's names, internal TransUnion identifiers, passport information, ages, dates and places of birth, employers, summary of financial transactions, credit scores, and loan details, among other sensitive material.

According to VX-Underground, which flagged up the dump on Twitter over the weekend, a copy of this database appeared to have been snatched on March 2 last year.

TransUnion did admit in 2022 it suffered a security breach after criminals broke into a South African server and stole data relating to five million customers and 600,000 businesses.

In a brief statement issued on Tuesday, the credit-rating giant addressed USDoD's claims.

"TransUnion is aware of some limited online activity alleging that data obtained from multiple entities, including TransUnion, will be released," the biz said in its note Tuesday.

In what has become boilerplate language in responding to security snafus, the credit-report biz said it "immediately" took steps to respond to the claims, including partnering with outside cybersecurity and forensic experts and launching an investigation.

"At this time, we and our internal and external experts have found no indication that TransUnion systems have been breached or that data has been exfiltrated from our environment," the statement continued.

And then it points the blame elsewhere.

"Through our investigation, we have found that multiple aspects of the messages — including the data, formatting, and fields — do not match the data content or formats at TransUnion, indicating that any such data came from a third party."

TransUnion did not respond to The Register's inquiries, including whether it knows who the third party may be, how USDoD snatched the data in the first place, and if this leak is related to the 2022 security failure.

"Data protection is top priority at TransUnion. We take seriously any assertions regarding our information security and will continue to closely monitor this situation," the company's statement concluded.

USDoD is the same fiend named in court documents [PDF] related to the arrest of Conor Brian Fitzpatrick, aka pompompurin, who ran BreachForums before the Feds shut down an incarnation of the message board earlier this year. 

According to the court documents, USDoD in 2022 broke into the FBI's InfraGard, and then leaked contact details belonging to the almost 80,000 of the information-sharing network's members.

More recently, USDoD reportedly raided Airbus and posted personal information belonging to the aerospace giant's 3,200 vendors on a cyber-crime forum. ®

Updated to add

Transunion have confirmed the incident was not related to the March 2022 South African incident but is a new issue.

Tell your friends

Some readers ask us if they can support The Register through some kind of subscription. The best way to back El Reg and keep our journalism flowing is to spread the word on social media, tell a colleague, sign up for a Register account and our newsletters, and comment away on articles.

Find and share us on Bluesky, LinkedIn, and Twitter. Tip us off with news. And thank you for reading.

Send us news

Orgs are having a major identity crisis while crims reap the rewards

Hacking your way in is so 2022 – logging in is much easier

Feds dismantle Russian GRU botnet built on 1,000-plus home, small biz routers

Beijing, now Moscow.… Who else is hiding in broadband gateways?

Meet VexTrio, a network of 70K hijacked websites crooks use to sling malware, fraud

Some useful indicators of compromise right here

China's Volt Typhoon spies broke into emergency network of 'large' US city

Jeez, not now, Xi. Can't you see we've got an election and Ukraine and Gaza and cost of living and layoffs and ...

ALPHV blackmails Canadian pipeline after 'stealing 190GB of vital info'

Gang still going after critical infrastructure because it's, you know, critical

Ivanti devices hit by wave of exploits for latest security hole

At this point you might be better off just shutting the stuff down

Uncle Sam sweetens the pot with $15M bounty on Hive ransomware gang members

Honor among thieves about to be put to the test

The spyware business is booming despite government crackdowns

'Almost zero data being shared across the industry on this particular threat,' we're told

AnyDesk revokes signing certs, portal passwords after crooks sneak into systems

Horse, meet stable door

Crims found and exploited these two Microsoft bugs before Redmond fixed 'em

SAP, Adobe, Intel, AMD also issue fixes as well as Google for Android

Apple promises to protect iMessage chats from quantum computers

Easy to defend against stuff that may never actually work – oh there we go again, being all cynical like

Congress told how Chinese goons plan to incite 'societal chaos' in the US

American public is way ahead of them