Controversies
Controversies tied to this brand in public sources. A listing is not a finding of fault.
Back to profile12 entries
2026
TransUnion controversy: Frontline Education data breach exposed Lubbock ISD employee personal information
Issue disclosure
Frontline Education notified Lubbock ISD on October 6, 2026 that a security incident occurring on August 14, 2026 exposed employee Social Security numbers, email addresses and physical addresses; the district says district leadership was not notified until more than seven weeks after the incident, and Frontline told the district that no student information was exposed. Frontline says it discovered and remediated the incident on August 15, plans to begin contacting affected individuals on October 26, has notified the Texas Attorney General and law enforcement agencies, and is partnering with TransUnion to provide two years of credit monitoring to affected people.
Company response
Remediation — Frontline Education
Refund or compensation — Frontline Education
Ongoing disclosure — Frontline Education
Frontline plans to begin contacting affected individuals on October 26th.
Ongoing disclosure — Frontline Education
Frontline has also notified the Texas Attorney General and law enforcement agencies
Source excerpt
According to information provided to Lubbock ISD by Frontline Education, the security incident occurred on August 14th, 2026.
Frontline has told the district that no Lubbock ISD student information was exposed in the incident.
Lubbock ISD announced Tuesday, October 6th, that employee Social Security numbers were among the information exposed during a security incident involving Frontline Education.
2026
Loblaw discloses breach impact and begins customer notifications
Issue disclosure
Loblaw stated that it was beginning to notify approximately two million Canadians affected by a data breach that occurred in March. The company said the notifications include details about which personal information was exposed. According to Loblaw, the information involved varied by customer. The disclosure concerns the scope of the breach's impact on affected individuals and the start of customer notifications.
Loblaw said it was starting to notify about two million Canadians affected by a March data breach, with details about which personal information was exposed. It said the information involved varied by customer.
Company response
Ongoing disclosure — Loblaw
Loblaw says it is starting to notify about two million Canadians who were affected by a data breach in March with specifics about which personal information of theirs leaked.
Remediation — Loblaw
It is offering complimentary credit monitoring and identity restoration services through TransUnion.
Source excerpt
It is offering complimentary credit monitoring and identity restoration services through TransUnion.
Loblaw says it is starting to notify about two million Canadians who were affected by a data breach in March with specifics about which personal information of theirs leaked.
The company said in March that it detected suspicious activity on its IT network and determined an unauthorized third party had accessed some basic customer information but didn’t disclose how many customers were affected at the time.
2022
TransUnion South Africa data-breach claims
TransUnion South Africa disclosed a server intrusion after an extortion group claimed to have taken data involving approximately 54 million customers and demanded payment.
2022
TransUnion discloses South African data breach
Issue disclosure
TransUnion confirmed it was hacked through misuse of an authorized client’s credentials. A hacking group alleged it accessed personal information belonging to 54 million consumers; TransUnion said it was working with external experts to determine what data was affected.
Company response
Investigation — TransUnion
Our team is working closely with external experts to gain an understanding of what data was affected.
Remediation — TransUnion
The global consumer credit bureau says it will be offering âimpacted consumersâ an annual subscription to its identity protection product, TrueIdentity, free of charge
Source excerpt
Our team is working closely with external experts to gain an understanding of what data was affected.
TransUnion says the hacking group obtained access via misuse of an authorised clientâs credentials and the relevant account has been suspended.
Criminal hacking group N4aughtysecTU, allegedly based in Brazil, has claimed responsibility, alleging that it has accessed the personal information of 54 million consumers, amounting to roughly 4 terabytes of data.
2022
TransUnion confirms breach affecting South Africa business
Issue disclosure
TransUnion confirmed a data breach affecting its South Africa business. The article reports that cybercriminals accessed a South Africa server using a client's credentials; TransUnion said the compromised data was held on an isolated server and described as limited. The attackers claimed to have stolen files, but that claim is attributed to the attackers.
Company response
Ongoing disclosure — TransUnion
In a statement issued on Thursday, the company said cybercriminals gained access to a TransUnion South Africa server using a client’s credentials.
Source excerpt
Credit reporting giant TransUnion has confirmed a data breach affecting its South Africa business.
In a statement issued on Thursday, the company said cybercriminals gained access to a TransUnion South Africa server using a client’s credentials.
The affected client’s access was suspended after the breach was discovered and some services have been taken offline.
2020
TransUnion sued over alleged use of watch-list data in consumer reports
Lawsuit filed
A class action complaint filed in the Eastern District of Pennsylvania alleged that TransUnion included terrorist watch-list information in consumer reports in violation of the Fair Credit Reporting Act. The allegations were not stated as a court determination. The event was reported in 2020.
Source excerpt
[1] Al-Shaikli v. TransUnion, LLC, 5:20-cv-04155 (E.D. PA. August 24, 2020).
Earlier this week, one of the “big three” credit bureaus was sued in the Eastern District of Pennsylvania over an alleged practice that the Ninth Circuit and the Third Circuit had previously determined violated the FCRA in unrelated class action litigation against the same credit bureau.
The class action complaint alleges that TransUnion, LLC (“TransUnion”) included information found on terrorist watch lists in its consumer reports in violation of the FCRA.
2017
CFPB enforcement over credit-score products and subscriptions
The CFPB announced a $5.5 million civil penalty and $17.6 million in restitution involving TransUnion and alleged deception about the value and cost of credit scores and recurring payments for credit-related products.
2017
Fair Credit Reporting Act security-list verdict
A California jury awarded $60 million in a case alleging that TransUnion falsely reported consumers as associated with terrorism and other government security lists.
2017
TransUnion Central America website compromise
The Central American division's website was reported to have redirected visitors toward malware downloads after third-party analytics JavaScript was compromised.
2015
New York consumer-reporting settlement
TransUnion and the other major U.S. credit-reporting companies agreed to procedures intended to improve the handling of disputed errors and consumer red flags, including use of trained personnel to communicate with data furnishers.
2006
Identity-theft reporting litigation
A consumer who said identity theft had produced erroneous credit information sued the three major U.S. credit bureaus. TransUnion and Experian settled outside court for undisclosed amounts.
2003
Lawsuit over inaccurate credit information
Judy Thomas of Oregon won a lawsuit against TransUnion after reportedly spending six years seeking removal of incorrect information from her credit report. The award was reported as $5.3 million.