TransUnion: Only TransUnion Cases Set to Merge Over Salesforce Data Breach

**Salesforce Data Breach Lawsuits Remain Fragmented, Except for TransUnion Case**

A series of lawsuits tied to social engineering attacks targeting Salesforce databases will not be consolidated into a single multidistrict litigation (MDL), with one exception: complaints against TransUnion, which will proceed in federal court in Illinois.

The U.S. Judicial Panel on Multidistrict Litigation ruled that the cases lack sufficient commonality, as each breach involves distinct incidents with varying details. Most complaints do not directly implicate Salesforce or allege a shared vulnerability in its platform as a key factor. Instead, the lawsuits stem from separate attacks where unique circumstances will shape the legal proceedings.

The decision underscores the fragmented nature of these breaches, with no overarching pattern linking them beyond the use of social engineering tactics. The TransUnion case will move forward independently, while other claims remain dispersed across different jurisdictions.

Source: https://news.bloomberglaw.com/privacy-and-data-security/only-transunion-cases-set-to-merge-over-salesforce-data-breach

TransUnion cybersecurity rating report: https://www.rankiteo.com/company/transunion

"id": "TRA1766008553",
"linkid": "transunion",
"type": "Breach",
"date": "12/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'location': 'Illinois, USA',
                        'name': 'TransUnion',
                        'type': 'Company'},
                       {'type': 'Multiple Companies'}],
 'attack_vector': 'Social Engineering',
 'description': 'Recent data breach lawsuits stemming from social engineering '
                'attacks against Salesforce databases won’t be consolidated, '
                'except for complaints filed against TransUnion set for '
                'federal Illinois court. The still-disparate Salesforce data '
                'breach suits allege separate attacks where different facts '
                'will emerge for each event.',
 'impact': {'legal_liabilities': 'Lawsuits filed',
            'systems_affected': 'Salesforce databases'},
 'references': [{'source': 'US Judicial Panel on Multidistrict Litigation'}],
 'regulatory_compliance': {'legal_actions': 'Lawsuits filed'},
 'title': 'Salesforce Data Breach Lawsuits from Social Engineering Attacks',
 'type': 'Data Breach'}