What Is the TransUnion Lawsuit?
The TransUnion lawsuit is a group of separate federal cases against the credit bureau Trans Union, LLC, led by the multidistrict litigation over its July 2025 data breach. That litigation is MDL No. 3170, In re: Trans Union, LLC, Customer Data Security Breach Litigation, in the U.S. District Court for the Northern District of Illinois.
The defendant has contested the claims in court, and TransUnion's headquarters is in Chicago, which the Judicial Panel on Multidistrict Litigation cited when it chose that district.
Many people searching this topic mean a different TransUnion case, such as the $8.31 million bankruptcy remark class action settlement or the $23 million dispute handling settlement. Those are credit reporting cases, not data breach cases, and the comparison section below separates them.
“There are 54 cases against TransUnion pending in five district courts. All actions listed on Schedule B include claims against TransUnion arising from the same data breach affecting TransUnion customers.”
Source: U.S. Judicial Panel on Multidistrict Litigation, In re: Trans Union, LLC, Customer Data Security Breach Litigation, MDL No. 3170, Transfer Order and Order Denying Transfer, Document 187 (December 16, 2025)
Why Are People Filing TransUnion Lawsuits?
People are filing TransUnion lawsuits because the credit bureau is accused of failing to protect personal data in a July 2025 breach, and separately of mishandling the accuracy of credit reports and consumer disputes. The data breach cases are the newest and the largest group.
TransUnion told state regulators that about 4.46 million people were affected, and it reported that names, birth dates, and Social Security numbers were involved. It said the unauthorized access reached a third-party application used for U.S. consumer support and did not involve credit reporting data. TransUnion offered affected people 24 months of free credit monitoring through its myTrueIdentity service.
The Judicial Panel on Multidistrict Litigation described the common questions in the breach cases as what duties TransUnion owed plaintiffs to protect their personal information, how the hackers executed their social engineering attack, whether TransUnion had adequate procedures to prevent it, and whether TransUnion responded adequately. A Bloomberg Law report on the first complaint says it also alleges TransUnion failed to notify affected people on time and violated the Federal Trade Commission Act.
The defendant contests the allegations, and no court has found TransUnion liable for the breach.
What Injuries Are Included in the TransUnion Lawsuit?
The injuries included in the TransUnion lawsuit are mainly privacy, identity-theft, and credit reporting harms, not physical injuries. The four categories below come from the breach plaintiffs and from two credit reporting class actions, and the defendant has contested the claims in each.
Exposure of Social Security Numbers
A Social Security number is a nine-digit federal identifier that lenders and government agencies use to confirm a person's identity.
The breach plaintiffs allege the intrusion exposed Social Security numbers along with names and birth dates, which raises the risk of fraudulent credit applications. TransUnion has said the incident did not involve credit reporting data.
Exposure of a number is not the same as misuse of it. The claims rest on the allegation that the added risk, and the time and money spent guarding against it, are harm the law can compensate.
Increased Risk of Identity Theft
Identity theft is the use of another person's personal information, without permission, to open accounts, borrow money, or commit fraud.
The breach complaints plead negligence, negligence per se, breach of implied contract, and unjust enrichment, according to a report on one filed complaint. They seek compensatory damages and injunctive relief, including stronger security practices.
Courts often examine whether a data breach plaintiff has alleged a concrete harm. The 2021 Supreme Court decision in TransUnion LLC v. Ramirez, described in the comparison section below, is the leading ruling on that question.
Inaccurate Bankruptcy Remarks on Credit Reports
A bankruptcy remark is a note on a credit account that says the account was included in a bankruptcy filing.
The Brooks class action alleges TransUnion sold credit reports that carried a bankruptcy remark on an account tradeline with no matching bankruptcy in the public record section of the report. TransUnion has not admitted wrongdoing, and the case settled for $8.31 million.
This is a Fair Credit Reporting Act claim and is separate from the data breach. The status section below gives the dates and the claims process.
Mishandled Credit Report Disputes
A credit report dispute is a written request asking a credit bureau to investigate and correct or remove information on a person's file.
The Norman class action alleged TransUnion failed to reasonably investigate written disputes about hard inquiries and answered with a standardized letter. TransUnion denied wrongdoing and settled for $23 million.
This claim is also separate from the data breach, and the settlement required TransUnion to change how it handles those disputes.
Who Qualifies for the TransUnion Lawsuit?
You may qualify if:
- You received a breach notice from TransUnion about the July 2025 incident, which can indicate your personal information was involved
- You are a U.S. consumer who contacted TransUnion for support, since the breached application was used for U.S. consumer support
- You can describe harm or risk tied to the exposure, such as a fraud alert, misuse of your Social Security number, or money spent on credit protection
- You are in a different TransUnion case's class, such as a person whose report carried an inaccurate bankruptcy remark, which a separate settlement covered
You may not qualify if:
- TransUnion never held your information and never sent you a breach notice
- You are a defendant, an officer or employee of a defendant, or a judge on the case
- Your claim was already released in a settlement, such as a person who did not opt out of the Brooks or Norman settlements, which cover only credit reporting claims
No class has been certified in MDL 3170, and the court has not set a claims process. Whether a person has a viable claim depends on the state, the information involved, and filing deadlines, and only a qualified attorney reviewing the facts can confirm it. TransUnion's offer of free credit monitoring was not a settlement.
What Is the Current Status of the TransUnion Lawsuit?
The current status of the TransUnion lawsuit is active pretrial litigation in MDL 3170, with no settlement, fund, or claim form for the data breach. As of October 1, 2026, the Judicial Panel on Multidistrict Litigation counts 67 actions filed and 62 still pending. Two credit reporting class actions are tracked separately below, and one of them is awaiting final approval.
MDL No. 3170 (Data Breach)
The Judicial Panel on Multidistrict Litigation centralized the TransUnion data breach cases on December 16, 2025 and assigned them to Judge Robert W. Gettleman in the Northern District of Illinois. TransUnion had moved on October 3, 2025 to centralize 53 actions, and the order counted 54 cases against TransUnion in five district courts.
The Panel denied a competing request, MDL No. 3164, for one large multi-defendant Salesforce MDL. It reasoned that each Salesforce customer's breach involved different facts, and it found a TransUnion-only MDL appropriate.
The pending count stood at 60 of 61 filed actions in the February 2026 report and reached 66 of 67 in the May 2026 report. It was 62 of 67 on October 1, 2026, so five actions have ended.
This page could not confirm a consolidated class complaint, the appointment of interim lead counsel, or a ruling on any motion to dismiss. The court's docket in the lead case, No. 1:25-cv-10320, is the place to check them. No court has found TransUnion liable.
| Proceeding Type | Federal MDL (28 U.S.C. § 1407), putative class actions |
| Court | U.S. District Court for the Northern District of Illinois |
| Docket | Lead case 1:25-cv-10320 (Snelgrove v. TransUnion, LLC) |
| Judge | Robert W. Gettleman |
| Centralized | December 16, 2025 |
| Actions | 67 filed, 62 pending as of October 1, 2026 (JPML report) |
| Defendant | Trans Union, LLC |
| Settlement Status | None reported as of November 1, 2026 |
Brooks v. Trans Union, LLC (Bankruptcy Remarks)
This is a Fair Credit Reporting Act class action over bankruptcy remarks that appeared on credit report accounts without a matching bankruptcy record. Settlement coverage names Judge Karen Spencer Marston of the Eastern District of Pennsylvania. The court granted preliminary approval on July 6, 2026, and the final approval hearing is set for December 2, 2026.
The settlement fund is $8.31 million for about 57,000 people whose reports were sold between January 6, 2020 and January 31, 2023. About 21,000 people in the No Bankruptcy Group receive an automatic $100, and a valid claim raised the estimate to about $1,000. About 36,000 people in the Aged Bankruptcy Group had to file a claim for an estimated $350. Amounts differ between sources and depend on the number of valid claims.
Claims, opt-outs, and objections were due October 30, 2026. Payments begin only after final approval and any appeals, and no payment date has been announced. TransUnion has not admitted wrongdoing.
| Proceeding Type | Federal class action settlement (not an MDL) |
| Court | U.S. District Court for the Eastern District of Pennsylvania |
| Docket | 2:22-cv-00048 |
| Settlement Fund | $8,310,000 |
| Class Size | About 57,000 people |
| Claims Deadline | October 30, 2026 (passed) |
| Final Approval Hearing | December 2, 2026 |
| Settlement Website | BrooksBankruptcyClassAction.com |
Norman v. Trans Union, LLC (Dispute Handling)
This class action alleged TransUnion did not reasonably investigate written disputes about hard inquiries and answered with a standardized letter. The named plaintiff filed it on December 5, 2018, and the settlement covers about 485,000 people who received that letter between December 5, 2016 and January 31, 2025.
The court granted preliminary approval on February 24, 2025, and the fairness hearing was set for July 21, 2025. One claim tracker reports final approval on July 22, 2025 and payments issued on September 10, 2025, and this page did not read the court's order. Automatic payments were estimated at $20 to $30, with up to $160 for people who attested to a specific harm.
| Proceeding Type | Federal class action settlement (not an MDL) |
| Court | U.S. District Court for the Eastern District of Pennsylvania |
| Docket | 2:18-cv-05225 |
| Settlement Fund | $23,000,000 |
| Class Period | December 5, 2016 to January 31, 2025 |
| Claims Deadline | June 24, 2025 (passed) |
| Settlement Status | Final approval and payments reported by one claim tracker |
How Much Will I Get From the TransUnion Lawsuit Settlement?
The amount you will get from the TransUnion lawsuit settlement is not yet known for the data breach case, because no settlement or fund exists, while two credit reporting settlements have set payouts for their own classes.
Any payout depends on the case, the number of valid claims, and court approval, and nobody can promise a figure. Settlements in other data breach cases vary widely, and none of them predicts what MDL 3170 will produce, if it settles at all.
The Brooks settlement estimates an automatic $100 payment for one group and about $1,000 or $350 for claimants, but its claims deadline passed on October 30, 2026 and payments wait for final approval.
The Norman settlement estimated $20 to $30 automatically and up to $160 for people who documented harm, and its claim period closed in June 2025.
A website offering a TransUnion breach claim form deserves caution until a court-approved notice exists, because the breach case has no settlement administrator.
TransUnion Lawsuit Updates
Here are the latest TransUnion lawsuit updates, covering new court filings, rulings, and case-count reports as they're confirmed. MDL 3170, the federal TransUnion data breach litigation, continues in active pretrial proceedings as of November 2026, with no global settlement reached. See the full timeline below for every confirmed development since the litigation began.
Full TransUnion Lawsuit Timeline
Brooks Settlement Claims, Opt-Out, and Objection Deadline Passes
The deadline to file a claim, opt out, or object in the $8.31 million Brooks v. Trans Union, LLC settlement passed on October 30, 2026. The final approval hearing before Judge Karen Spencer Marston is set for December 2, 2026.
MDL 3170 Pending Count Falls to 62 of 67 Actions
The Judicial Panel on Multidistrict Litigation's October 1, 2026 report lists 62 pending actions out of 67 filed in MDL 3170 before Judge Robert W. Gettleman. The pending figure had been 63 in each monthly report from June through September.
Court Preliminarily Approves the Brooks Bankruptcy Remark Settlement
The court granted preliminary approval on July 6, 2026 to the $8.31 million settlement of Brooks v. Trans Union, LLC. The settlement covers about 57,000 people whose credit reports carried a bankruptcy remark with no matching public record.
MDL 3170 Pending Count Slips to 63 After a Peak of 66
The June 1, 2026 Judicial Panel report counted 63 pending actions out of 67 filed in the TransUnion data breach MDL. The May 1 report had counted 66, so three actions closed in a single month.
MDL 3170 Reaches 66 Pending Actions
MDL 3170 held 66 pending actions out of 67 filed in the Judicial Panel's May 1, 2026 report, the highest pending count in the 2026 reports reviewed for this page.
Pending Count Reaches 64 of 65 Actions
The Judicial Panel's April 1, 2026 report listed 64 pending actions out of 65 filed in MDL 3170, up from 60 in the February and March reports as tag-along cases arrived.
February 2026 Report Counts 60 Pending Actions
The Judicial Panel's February 2, 2026 report listed 60 pending actions out of 61 filed in MDL 3170, the first monthly count reviewed after the December 2025 centralization.
JPML Centralizes the Data Breach Cases as MDL 3170
The Judicial Panel on Multidistrict Litigation issued its Transfer Order (Document 187) on December 16, 2025, centralizing 54 cases against TransUnion in the Northern District of Illinois before Judge Robert W. Gettleman. The same order denied a multi-defendant Salesforce MDL, No. 3164.
TransUnion Moves to Centralize 53 Data Breach Actions
TransUnion moved on October 3, 2025 before the Judicial Panel to centralize 53 actions arising from its data breach in the Northern District of Illinois. The motion was docketed as MDL No. 3170 and competed with a broader Salesforce request.
TransUnion Data Breach Occurs
Unauthorized actors accessed a third-party application TransUnion used for U.S. consumer support on or around July 28, 2025, according to a filed complaint. TransUnion later told the Maine attorney general that 4,461,511 people were affected.
Fairness Hearing Held in the Norman Dispute Settlement
The court's fairness hearing in the $23 million Norman v. Trans Union, LLC settlement was set for July 21, 2025. One claim tracker reports final approval on July 22, 2025, which this page did not confirm from the order.
CFPB Drops Its Lawsuit Against TransUnion
The Consumer Financial Protection Bureau voluntarily dismissed with prejudice its 2022 lawsuit against TransUnion on February 28, 2025, according to Law360. The suit had alleged deceptive marketing practices and violations of a 2017 consent order.
Norman Dispute Settlement Preliminarily Approved
The court granted preliminary approval on February 24, 2025 to the $23 million settlement of Norman v. Trans Union, LLC. The class covered about 485,000 people who received a standardized dispute response letter.
Court Grants Final Approval of the Ramirez Settlement
The court granted final approval on December 15, 2022 to the $9 million settlement of Ramirez v. TransUnion on remand from the Supreme Court. Class counsel estimated payments above $2,000 for class members who proved their report was shared with a third party.
CFPB Sues TransUnion and a Former Executive
The Consumer Financial Protection Bureau sued TransUnion, two subsidiaries, and former executive John Danaher on April 12, 2022. It alleged violations of a 2017 consent order, and Director Rohit Chopra called the company an out-of-control repeat offender.
Supreme Court Decides TransUnion LLC v. Ramirez
The U.S. Supreme Court decided TransUnion LLC v. Ramirez on June 25, 2021 and overturned a $60 million jury verdict. It held that class members whose inaccurate OFAC alerts were never sent to a third party lacked standing to sue for damages.
Norman Dispute Handling Class Action Filed
The named plaintiff filed Norman v. Trans Union, LLC, No. 2:18-cv-05225, on December 5, 2018. The complaint alleged TransUnion failed to reasonably investigate disputes about hard inquiries.
How to File a TransUnion Lawsuit
Here are the 6 steps to file a TransUnion lawsuit.
- Locate any breach notice you received: TransUnion sent notices to affected people by mail or email, and keeping the notice helps show your data may have been involved.
- Confirm whether you contacted TransUnion for support: The breached application supported U.S. consumer support, so past support contacts can matter to whether you are in the affected group.
- Document any misuse of your information: Save fraud alerts, credit report entries, identity theft reports, and receipts for credit protection, since they show real harm.
- Check your credit and consider a freeze: A credit freeze with the three bureaus is free and limits new accounts opened with a stolen Social Security number.
- Consult a data breach attorney: Firms on this litigation work on contingency, and a lawyer can explain whether to join MDL 3170 and what your state's deadlines are.
- Use only official sources for any claim form: No breach settlement exists, and the Brooks settlement's official site is BrooksBankruptcyClassAction.com, so treat any other claim site with caution.
Answer a few questions and a case reviewer will follow up. Free, no obligation.
A case reviewer will follow up soon.
What Did TransUnion Allegedly Know Before the Data Breach?
The breach plaintiffs allege TransUnion failed to implement and maintain reasonable security procedures to protect personal information. The Judicial Panel's order says threat actors allegedly used social engineering to reach a Salesforce database that TransUnion controlled, and it lists adequacy of TransUnion's procedures as a common question in the cases.
TransUnion has said the incident reached a third-party application and did not touch core credit reporting data, and it contests the claims. The Panel did not decide any of those questions.
TransUnion has also faced federal regulatory action before. The Consumer Financial Protection Bureau sued in 2022 over alleged violations of a 2017 consent order, and the Bureau dropped that suit in February 2025, so it produced no finding against the company.
| Party | Role | Position |
|---|---|---|
| Trans Union, LLC | Credit bureau whose consumer support application was accessed | Contests the claims, and moved to centralize the cases in Chicago |
| Salesforce, Inc. | Provider of the platform TransUnion used, named in some early complaints | Not a defendant in the TransUnion-only MDL order, and the Panel denied the Salesforce MDL |
| Consumer Financial Protection Bureau | Federal regulator that sued TransUnion in 2022 | Dismissed its suit with prejudice in February 2025 |
How Does the TransUnion Lawsuit Compare to Other TransUnion Cases?
The TransUnion data breach lawsuit is one of several unrelated cases against the same company, and only the credit reporting cases have produced settlements. Matching the right case to your situation matters, because a payment notice from one case does not mean your breach claim was paid.
| Case | What It Involves | Status |
|---|---|---|
| TransUnion data breach, MDL No. 3170 | Unauthorized access to personal information in a consumer support application in July 2025 | Pending, no settlement or claim form reported |
| Brooks v. Trans Union, LLC | Bankruptcy remarks on credit reports with no matching public record | Settled, final approval hearing set for December 2, 2026 |
| Norman v. Trans Union, LLC | Failure to reasonably investigate disputes about hard inquiries | Settled, claim period closed in June 2025 |
| TransUnion LLC v. Ramirez | Inaccurate alerts matching consumers to a federal sanctions watch list, decided by the Supreme Court in 2021 | Settled for $9 million after remand |
| Consumer Financial Protection Bureau v. TransUnion | Alleged violations of a 2017 consent order | Dismissed by the agency in February 2025 |
| List class action and Wang v. Asset Acceptance, LLC | Older class actions: a $75 million credit report settlement in 2008 and a $1 million disputed-account settlement | Closed |
Frequently Asked Questions
What is the TransUnion lawsuit about?
The TransUnion lawsuit is mainly about the July 2025 TransUnion data breach, in which unauthorized actors accessed a consumer support application and exposed names, birth dates, and Social Security numbers. The cases are consolidated as MDL No. 3170 in the Northern District of Illinois, and separate credit reporting class actions have settled.
Is the TransUnion lawsuit a class action or an MDL?
The TransUnion data breach lawsuit is an MDL, not a certified class action, although plaintiffs seek certification of classes. The Brooks and Norman cases, by contrast, are class actions that settled.
Is the TransUnion class action lawsuit real?
Yes, the TransUnion class action lawsuit is real, and the Judicial Panel on Multidistrict Litigation created MDL No. 3170 on December 16, 2025. The Brooks settlement is also real, and its official site is BrooksBankruptcyClassAction.com.
Is there a TransUnion lawsuit settlement for the data breach?
A TransUnion lawsuit settlement exists for the credit reporting cases, not the data breach. The Brooks case created an $8.31 million fund and the Norman case a $23 million fund, while MDL 3170 has no settlement, fund, or claim form as of November 1, 2026.
How much will I get from the TransUnion class action lawsuit?
You would have received an automatic $100 or an estimated $350 to $1,000 from the Brooks settlement, depending on your group and a valid claim, but the claims deadline passed on October 30, 2026. The data breach case has no payout yet, and any future amount depends on a settlement or judgment.
Can I still file a claim in the TransUnion lawsuit?
No claim form exists for the TransUnion data breach lawsuit, and the Brooks claims deadline passed on October 30, 2026. People affected by the breach can speak with an attorney about their options and their state's deadlines.
Is the TransUnion data breach lawsuit the same as the Brooks settlement?
No, the TransUnion data breach lawsuit and the Brooks settlement are separate cases over different conduct. The breach case is MDL No. 3170 in Illinois, while Brooks is Brooks v. Trans Union, LLC, No. 2:22-cv-00048, in Pennsylvania over bankruptcy remarks on credit reports.