TransUnion Data Breach Lawsuit
More than 4.4 million people, and the only case from this wave of breaches that a federal panel agreed to centralize — MDL 3170 in Chicago.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Happened
An attacker reached a third-party system holding TransUnion consumer data on 28 July 2025; TransUnion discovered it two days later, on 30 July. More than 4.4 million people were affected. The sensitivity here is different in kind from most breaches: TransUnion is one of the three national credit bureaus, so the records it holds are the same records lenders use to decide whether you are who you say you are. As with the other breaches in this wave, the way in was social engineering aimed at TransUnion’s own database, not a flaw in the platform beneath it.
Case Details
MDL No. 3170, In re: Trans Union, LLC, Customer Data Security Breach Litigation, United States District Court for the Northern District of Illinois, before Judge Robert W. Gettleman. The panel centralized 54 cases from five district courts on 16 December 2025, choosing Chicago because TransUnion is headquartered there and most cases were already filed in that district.
Where the Case Stands
Who Is Covered
People whose information was in the affected system in late July 2025 — more than 4.4 million by TransUnion’s own count. Worth understanding: you do not have to have been a TransUnion customer to be in a credit bureau’s files. Bureaus hold data on people who never contacted them, which is why many recipients of the notification letter had no idea they had a relationship with TransUnion at all. The letter is the practical proof of membership.
What a Case Like This Pays
Timeline
- 1
28 July 2025 — the intrusion
An attacker reaches a third-party system holding TransUnion consumer data.
- 2
30 July 2025 — discovery
TransUnion discovers the incident, two days after it began.
- 3
From August 2025 — lawsuits
Proposed class actions are filed across several federal districts.
- 4
3 October 2025 — TransUnion asks for its own MDL
TransUnion moves to centralize 53 actions in the Northern District of Illinois, separately from the broader Salesforce motion.
- 5
16 December 2025 — MDL 3170 created
The panel centralizes 54 cases from five districts before Judge Robert W. Gettleman in Chicago, while refusing to create a combined Salesforce MDL.
- 6
2026 — pretrial proceedings
The consolidated case moves through pretrial stages. No settlement has been reached and no administrator appointed.
Three Things That Are Not the Lawsuit
A credit bureau breach draws more impersonation than most, because the callers can sound plausible about your finances. These three are worth recognising.
A “claim form” for a case that has not settled
There is no settlement in the TransUnion matter, which means there is no claim form, no claims administrator and no deadline. Any site or letter inviting you to file a claim and asking for a fee, your Social Security number or your bank details is not connected to this litigation. Joining a class action never costs money up front.
Callers who already “have your file”
Because the notification letters went to a known list of people, that list is valuable to callers who pretend to be from the company, a law firm or a regulator. A real firm will not cold-call demanding a payment or an account number to “release” compensation. Hang up and call back on a number you looked up yourself.
Credit monitoring you are asked to pay for
Where a company offers monitoring after a breach, it pays for it. If someone bills you for monitoring “because of the breach”, that is not the company's offer. Separately, a security freeze at each of the three bureaus is free by federal law and does more than monitoring does, because it blocks new accounts instead of reporting them afterwards.
Frequently Asked Questions
Is this the same as the other TransUnion settlements I have seen?
No, and this is the most common mix-up. TransUnion has been through several separate matters — including a settlement about how bankruptcy remarks were reported and one under the Fair Credit Reporting Act — which have their own claim forms and their own deadlines. This page is about the July 2025 data breach only. That case has no settlement and no claim form.
What does “MDL 3170” actually mean for me?
It means 54 separate lawsuits are being handled together before one judge in Chicago for the pretrial stage — discovery, motions, class certification — instead of each court repeating the same work. It is not a settlement and not a verdict. If the case resolves, notice would go out to the class; until then there is nothing to file.
I never signed up with TransUnion. Why am I in this?
Credit bureaus collect data about people from lenders and other sources rather than from the people themselves, so there is no signing up to be in their files. That is precisely one of the grievances in these complaints: the class never chose the relationship and could not walk away from it.
Is there a settlement I can claim from?
No. As of August 2026 there is no settlement in the TransUnion litigation, no claims administrator and no deadline. Anything presenting itself as a claim form for this case is not what it says it is.
Does joining cost me anything?
No. Data breach class actions are handled on contingency: the firms are paid out of a settlement or judgment if there is one, and nothing if there is not. You are never asked for money up front, and anyone who does ask is not a class action lawyer.
What should I do right now, regardless of the lawsuit?
Freeze your credit at all three bureaus — it is free, takes about ten minutes each, and blocks new accounts rather than just reporting them after the fact. Keep the notification letter: it is the simplest proof that you are in the affected group. And write down any costs you incur, because documented losses are the part of a breach claim that pays the most.
How long do these cases take?
Longer than people expect. A data breach class action that settles typically takes two to four years from the first complaint to money reaching class members, and the steps in between — motions to dismiss, class certification, appeals — can each add a year. There is no shortcut, and a case moving slowly is not a sign that it is going badly.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.