Transunion (Partial) Breach

The incident is one of several breaches affecting Salesforce in 2025. A group calling itself "Scattered LAPSUS$ Hunters" released a limited sample of the stolen database on October 3, 2025. The records have since been indexed and anonymized in our search engine.

According to the attackers, the full dataset is scheduled for release on October 10, 2025.

Data found in hackers’ sample -

🧍 Personal Information

• Full name - ✅ Present
• First / last / middle names - ✅ Present
• Date of birth - ⛔ Mostly empty
• Social Security numbers - ⚠️ Present in about 1% of records
• Gender - ⛔ Empty

📧 Contact Information

• Email address - ✅ Present
• Phone number - ✅ Present
• Alternate phone numbers - ⛔ Empty
• Mailing address (street, city, state, ZIP, country) - ✅ Present (partial)
• Country - ✅ Present (“United States”)
• Latitude / longitude - ⛔ Empty

💳 Consumer & Account Data

• Account name / owner - ✅ Present
• Account status - ✅ Present (“Open”)
• Account creation & modification dates - ✅ Present
• Security freeze / alert dates - ⛔ Empty
• Unlock date - ⛔ Empty
• Number of aliases - ✅ Present (mostly 0)
• Customer ID / Party ID - ✅ Present
• Consumer consent flag - ✅ Present (mixed true/false)
• Is last authentication passed - ✅ Present (false)

💬 Customer Support & Chat Records

• Chat transcript ID - ✅ Present
• Chat content - ✅ Present (agent name, timestamps)
• IP address - ✅ Present
• Location - ✅ Present (“Chicago, IL, United States”)
• Browser / OS info - ✅ Present (Chrome, macOS)
• Session duration - ✅ Present
• Agent identity - ✅ Present (“TransUnion Support”)
• Visitor network - ✅ Present (“Trans Union, LLC”)
• Case linkage - ✅ Present (CaseId populated)

👩‍💼 Employee / User Information

• Employee name - ✅ Present
• Username - ✅ Present
• Email - ✅ Present
• Department / division - ✅ Present (“Consumer Operations”)
• Job title - ✅ Present (“VP”)
• Time zone / locale / language - ✅ Present
• Last login date - ✅ Present
• Active / inactive status - ✅ Present
• Profile / role ID - ✅ Present
• Call center ID - ✅ Present
• Federation ID - ✅ Present
• Manager & workgroup details - ✅ Present (partial)

⚙️ System Metadata

• Record IDs - ✅ Present
• Created / modified timestamps - ✅ Present
• SystemModstamp - ✅ Present
• Owner / creator / modifier IDs - ✅ Present
• Photo URLs - ✅ Present
• Currency - ✅ Present (“USD”)
• Privacy / opt-out flags - ✅ Present (false)