Consumer complaint received 2025-11-11 00:00:00
Product: Credit reporting or other personal consumer reports — Credit reporting
Issue: Incorrect information on your report — Account status incorrect
Company: TRANSUNION INTERMEDIATE HOLDINGS, INC.
State: CA

Complaint narrative:
b'Re: DATA BREACH - Supplemental / Revised Notice & Demand / Dispute / Data Breach + FCRA Violations\nSubject: Disputed items on file; persistent noncompliance; data breach; request for removal or correction; documentation; XXXXTo Whom It May Concern:\n\nI write as a follow-up and supplement to my prior dispute(s), and to place you on further notice of your ongoing noncompliance, and to demand immediate removal or correction of the disputed items. This letter restates and strengthens my position under the Fair Credit Reporting Act (15 U.S.C.  1681 et seq.), 47 U.S. Code  605  Unauthorized publication or use of communications, and related consumer protection and tort theories, and references recent legal developments.\n\nBelow is a statement of the facts, legal basis, demands, and preservation instructions. \n\n1. Statement of Facts  Timeline & Prior Disputes\n\t1.\tIn September 2024, I submitted the first formal dispute notice to TransUnion (or via a furnisher, as applicable) regarding multiple items/accounts on my credit file. That XXXX XXXX XXXXotice was included in the CFPB complaint and report you responded to.\n\t2.\tIn response to the CFPB complaint (filed after that dispute), XXXX   TransUnion removed only one of the disputed accounts, claiming to verify the remainder. You have not provided to me, nor (so far as I know), to any court or agency, any substantive creditor or lender documentation that supports your verification of those remaining disputed items (e.g. signed agreements, original statements, XXXX XXXXThe fact that you report many of the same accounts differently across Experian, Equifax, and TransUnion (or even differently from your prior XXXX representations) strongly suggests those items are inaccurate, improperly merged, misattributed, or otherwise erroneous. Indeed, the XXXX XXXX documentation (and the other CRA reports) demonstrate discrepancies that you have ignored or failed to reconcilXXXX  above demonstrates a pattern of ongoing noncompliance and violation of your duty under FCRA 1681i to reinvestigate disputed items, correct or delete inaccurate data, and provide rXXXX XXXXarately, TransUnion has recently disclosed a major data breach (XXXX XXXX XXXX) affecting approximately XXXX individuals, in which unauthorized actors accessed a third-party application tied to your consumer support operations.  \n\t\tThe breach reportedly exposed names, Social Security numbers, dates of birth, and other personally identifiable information (though you claim no credit information was accessed).  XXXXhis breach underscores systemic deficiencies in your data security, internal controls, and breach readiness, and calls into question the integrity of your verification and recordkeeping processes.\n\t\tThe public class action lawsuits (e.g. by firms investigating claims) already reference TransUnions failure to safeguard consumer data.  \n\nTogether, these facts support a claim that your verifications of my disputed items were not reasonable, and that you have persisted in reporting inaccurate information despite repeated noticeXXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX  are key legal principles and cases that support your obligations and potential liability.\n\n2.1 FCRA  Duty to reinvestigate & ensure accuracy\n\t\tUnder 15 U.S.C. 1681i(a), upon receipt of a consumers dispute, a credit reporting agency must conduct a reasonable reinvestigation, consider all relevant information provided, and promptly correct or delete information found to be inaccurate or unverifiable.\n\t\tUnder 15 U.S.C. 1681e(b), a credit reporting agency must follow reasonable procedures to assure maximum possible accuracy of the information in consumer reports.\n\t\tUnder 15 U.S.C. 1681g(b), a consumer has a right to receive a free description of the procedures used in the reinvestigation and the result.\n\t\tUnder 15 U.S.C. 1681i(d), you must provide notice of the results to furnishers and allow them to respond.\n\t\tUnder 15 U.S.C. 1681n (willful noncompliance) and 1681o (negligent noncompliance), I am entitled to statutory damages, actual damages, costs, and attorneys fees, as applicablXXXXBecause you have repeatedly ignored my dispute notices (from XXXX XXXX onward), and have failed to provide credible documentation supporting your verifications, your noncompliance is ongoing and may be willfuXXXX XXXX XXXXability, data security, and heightened scrutinXXXXhile FCRA typically governs credit reporting, the existence of a major data breach implicates additional legal theories (negligence, invasion of privacy, data security, breach of implied contract, etc.). The fact of the breach also raises the standard by which your verification and recordkeeping practices should be judged. Your admissions and public disclosures provide strong support for claims that your security controls and dispute-handling processes are deficient.\n\n2.3 Case law where plaintiffs prevailed (or favorable rulings) against TransUnion / CRAs\n\nHere are several relevant decisions you may draw upon or cite:\n\t\tArrizon v. TransUnion, LLC (XXXX XXXX XXXX XXXX Dist., XXXX XXXX XXXX)  In this case, the Illinois appellate court considered claims against TransUnion for dissemination of inaccurate information, including a long procedural history from federal to state court.  \XXXX v. TransUnion LLC, XXXX XXXX XXXX)  The court held that CRAs must ensure maximum possible accuracy, even for debts that are void under state law, and that a reasonable procedure must catch legal invalidity.  XXXX XXXX. TransUnion LLC, XXXX XXXX XXXX   XXXX XXXX XXXX  held that each class member must satisfy standing and that TransUnions placement of a false terrorist alert and mishandling of disclosures warranted damages.  XXXX XXXX  v. Ramirez, U.SXXXX XXXX XXXX XXXX   While the Supreme Court limited the ability of class members to recover in certain circumstances (holding that only those plaintiffs who suffered concrete harm have Article III standing), the decision reaffirmed the importance of the FCRAs protections and has been heavily discussed in the context of consumer reporting suits.  \n\t\tFluker v. Trans Union, XXXX XXXX XXXX XXXX   In that pending or decided district court litigation, the plaintiff alleged failure by TransUnion to reinvestigate identity theft disputes and failure to ensure accuracy of credit reports.  \n\nWhile not all of these are complete victories, they illustrate that courts have recognized consumer rights under FCRA and held CRAs liable in similar contexts.XXXX XXXX XXXX XXXX XXXXBased on the foregoing, I hereby repeat and expand my demands. You must, within XXXX XXXX  of your receipt of this letter:\n\t1.\tConduct a fresh, full, reasonable reinvestigation of every disputed item (including those you previously verified) in light of my XXXX XXXX dispute, my documentation, and the inconsistencies across CRAs and your own recordsXXXXroduce to me, in writing, the results of your reinvestigation, including:\XXXXThe identity (name, address, contact) of each furnisher/creditor from whom you obtained verification.\n\t\tAll documentation or data considered  e.g. account contracts, original creditor statements, chain-of-title, payment ledgers, or any other record that demonstrates the accuracy and ownership of the account.\n\t\tA description of the procedures you used in your investigation, including cross-checking among CRAs or internal consistency checksXXXXDelete or permanently suppress from my TransUnion credit file (and cease further reporting) any item for which you cannot provide competent, verifiable documentary support demonstrating that it is accurate, owned by me, or properly attributedXXXXNotify all furnishers of the disputed accounts that the information is disputed, and instruct them to cease reporting or updating the disputed items until the dispute is resolved.XXXXFlag my credit file with an identity theft or data breach alert (fraud alert or victim of data breach notation) to warn anyone reviewing the file of heightened XXXX distribution of my file (or portions thereof) to third parties for account-opening or creditgranting purposes until the dispute is resolved in my favor or you provide full documentatioXXXXPreserve all evidence  This includes all related documents, communications, logs, audit trails, internal notes, dispute investigation files, security and forensic reports related to your handling of my file, and all materials relating to the XXXX  data breach. You must not destroy or alter any relevant recordsXXXX  Demand for Immediate Removal of Unauthorized Hard Inquiries\n\nIn addition to the disputed accounts, I hereby formally dispute and demand the immediate removal of all hard inquiries listed on my TransUnion credit report whereXXXXo credit was extended,\n\t\tNo loan, service, or account was ever opened or approvedXXXX  did not receive any valuable consideration or benefit from the inquiry, andXXXX XXXXnd/or the reporting creditor have failed to produce any documentation justifying or authorizing such inquiry.\n\nLegal Basis:\n\nUnder the Fair Credit Reporting Act (15 U.S.C. 1681b), a consumer reporting agency may furnish a consumer report only under specific permissible purposes, such as:\n\t\tIn connection with a credit transaction that is initiated by the consumer (1681b(a)(3)(A)),\n\t\tFor employment purposes with written permission (1681b(a)(3)(B)),\n\t\tOr with the consumers express consent (1681b(c) and (e)).\n\nAny inquiry placed without a permissible purpose is a violation of FCRA, and a consumer has the right to demand its immediate deletion.\n\nAdditionally, an inquiry without a completed credit transaction or where no consideration was exchanged, constitutes a false representation of consumer-initiated credit activity, which injures the consumers creditworthiness, artificially lowers credit scores, and suggests false activity to potential lenders.\n\nIf a creditor or lender made an inquiry, but did not extend credit, did not open an account, and cannot prove that I provided informed, written, or recorded consent to that inquiry, it must be deleted under the FCRAs accuracy and permissible use provisions.\n\nSupporting Case Law:\n\nIn Pintor v. TransUnion, LLC, XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX the court held that a plaintiff stated a valid FCRA claim where TransUnion failed to remove inquiries that were allegedly made without the consumers knowledge or consent.\nXXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX the court emphasized that consumer reporting agencies must promptly delete inquiries where the furnisher cannot confirm a permissible purposeXXXXAccordingly, I hereby demand that all hard inquiries that meet any of the following conditions be immediately removed from my TransUnion credit file:\n\t\tThe lender or creditor did not extend credit, issue a loan, approve a service, or otherwise complete a transaction;\n\t\tI received no benefit or consideration (no value exchanged);\n\t\tThere is no signed authorization or proof of permissible purpose;XXXXhe inquiry was not initiated by me or lacks my express written consent.\n\nYou must also provide a written explanation ofXXXXhe original source and purpose of each hard inquiry;\n\t2.\tWhether credit was extended or a transaction completed;\n\t3.\tThe date and nature of any signed or recorded authorization you claim to have relied upon.\n\nFailure to remove unauthorized hard inquiries will constitute willful noncompliance under 15 U.S.C. 1681n and subject you to statutory and punitive damages.\n\n\nIf you fail to comply, I will proceed with all available legal remedies, including:\n\t\tFiling suit for statutory and actual damages (under 15 U.S.C. 1681n/1681o), injunctive relief, costs and attorneys fees\n\t\tJoining or initiating class action claims\n\t\tComplaints to the CFPB, FTC, state attorneys general, and other regulatory bodies\n\t\tSeeking punitive or exemplary damages (where available) for willful or reckless misconduct\n\nI require your written acknowledgment and substantive response within 30 days from receipt of this notice, sent to the address above. Failure to respond or refusal to remove or correct the disputed items will be considered willful noncompliance and will be used as evidence in any future litigation or regulatory action.\n\nSincerely,\n\nManuel Javier CarrilloXXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX  accompanies my TransUnion dispute submission regarding inaccurate and unlawfully obtained data linked to the TransUnion data breach. All items listed below are inaccurate, re-aged, misleading, or unauthorized and must be corrected or deleted immediately under the Fair Credit Reporting Act (15 U.S.C.  1681 et seq.),  604,  605B, and  623, as well as 47 U.S. Code  605, which prohibits the unauthorized publication or use of communications or data obtained without proper authorization.\n\n\n\nI. Verified and Accurate Personal Information\n\nField\tCorrect Information\tNotes\nFull XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX. Personal Information to Be Removed\nCategory\tInaccurate XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXXRemove all\tNot mine / duplicates\nEmployers\tMilayva Roof Co  Jamba Juice\tRemove\tOutdated or not affiliated\n\nIII. Accounts with Inaccurate or Misleading Reporting\n\nEach of the following accounts contains data-breach exposure, re-aging, or inconsistent reporting across bureaus, producing false delinquencies, charge-offs, or payment patterns.\n\n1. XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX  Pay Status: > Charge-off <\n\t\tInaccuracies: Business account incorrectly tied to personal credit; continuous Date Updated entries (XXXX) suggest unlawful re-aging. Payment-status history changes monthly, which misrepresents true closure.\n\t\tRequested Action: Delete immediately; business accounts are not consumer debts under FCRA.\n\n\n2. XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX > Paid, Closed <\n\t\tInaccuracies: Reported 120 days past due despite full payment XXXX XXXX XXXX XXXX  misstate closure.\n\t\tRequested Action: Correct to Paid as agreed / Closed  Never late or deleteXXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX  high-balance history altered; inconsistent late-payment pattern across bureaus; taxable charge-off misclassified as open delinquency.\n\t\tRequested Action: Delete or update to Closed XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX  differ by CRA; months reported 90 on TransUnion show OK elsewhere. Misleading to lenders.\n\t\tRequested Action: Remove all negative history or delete entire account for data integrityXXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXXCharge-off)\n\t\tInaccuracies: Successive Charge-off postings monthly through 09/25; indicates re-aging and false open status.\n\t\tRequested Action: Delete entirely; account is a completed charge-off (taxable event).\n\n\n\n6. XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX Status: Charge-off\n\t\tInaccuracies: Re-aged and reported as updated 10/06/25; misleads creditors and violates FCRA 623(a)(5).\n\t\tRequested Action: Delete immediatelyXXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX: Listed as joint account despite no joint contract; false placed for collection date XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX: Factoring account falsely assigned; consumer never contracted with XXXX XXXX XXXX XXXX XXXXelete immediatelyXXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXXs: Duplicate factoring entry; collection status without agreement; repeated updates after closure.\n\t\tRequested Action: Delete in full.\n\n\n\nIV. Requested Summary of Corrections\n\t1.\tKeep only the accurate personal information in Section I.\n\t2.\tRemove all inaccurate personal and employment data (Section II).\n\t3.\tDelete or correct each erroneous account (Section III).\n\t4.\tProvide written confirmation of all changes within 30 days.\n\n\n\nV. Unauthorized / Identity-Theft Inquiries\nXXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX\tNo permissible purpose; identity-theft suspected.\tDelete immediately & block future accessXXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXXUnauthorized soft inquiry; no application.\tDelete immediately\XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXXermissible purpose; possible breach data use.\tRemove & block access\nRXXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX  no credit application.\tDelete immediately\nFXXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXXUnauthorized access to file; no request made by consumer.\tRemove\nXXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX possible identity-theft link.\tRemove\nXXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXXNo permissible purpose; unauthorized inquiry.\tDelete immediately\nXXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX valuable consideration or credit exte\t\n\nSupporting Notes\n\t\tNone of the above inquiries were authorized by me or connected to legitimate credit applications.\n\t\tThese violations fall under FCRA 604(a) (no permissible purpose) and must be blocked per 605B (identity-theft provision).\n\t\tPlease confirm removal and initiate an identity-theft block across the file.'

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with non-monetary relief