TransUnion: Union Tank Car Roots, False OFAC Matches and a Password Breach

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

TransUnion was formed in 1968 as a holding company for the Union Tank Car Company, a Standard Oil descendant that leased rail tank cars for oil and chemicals. In 1969 it bought the Credit Bureau of Cook County in Illinois, with about 3.6 million credit accounts, and that side venture became the core business. The Marmon Group acquired TransUnion in 1981 for around $688 million, Goldman Sachs Capital Partners and Advent International bought it in 2010, and a $4 billion IPO followed in 2015. In October 2013 it launched CreditVision, which uses two years of trended data to show whether a borrower's balances are rising or falling.

Also in 2013 TransUnion bought TLO, whose TLOxp tool combines credit header data with public records for investigators, and e-Scan Data Systems for hospital insurance checks, then launched ResidentCredit for rent reporting in 2014. Judy Thomas of Oregon spent six years getting another person's debts removed from her file and won a $5.3 million jury award. In 2017 a California jury returned a $60 million verdict after name-only matching flagged consumers as possible matches to the Treasury's OFAC list, and the CFPB fined TransUnion $5.5 million and ordered $17.6 million in restitution over $1 credit score offers that turned into $17.95 monthly charges. In April 2022 the CFPB said the company was incapable of operating its businesses lawfully.

• By 2024 TransUnion had about 13,400 employees, 200 million U.S. files and projected 2025 revenue of $4.58 billion.
• Later purchases included alternative data and identity firms Neustar and Sontiq.
• In 2017 its Central American website loaded a compromised third-party analytics script that pushed a fake Adobe Flash update.
• In March 2022 TransUnion South Africa disclosed a breach of 54 million records, and the hackers claimed the server password was password.
• The episode links the security gaps to merging the legacy systems of many acquired companies.