Criminal Law Library Blog
Introduction.
The “big three” credit reporting companies, TransUnion, Equifax, and Experian, hold highly sensitive consumer financial data that can affect people’s access to credit, housing, employment, and insurance. Their data security posture depends not only on resisting large-scale hacking events, but also on preventing “low-tech” account takeovers that exploit customer service processes.
This post is based on Shira Ovide’s article, “It Wasn’t Hard to Highjack Trans Union Credit Reports, I Did it Myself. published in Tech Friend , a publication of the The Washington Post on December 12. 2025. In her article, drawing on months of testing by the Public Interest Research Group (PIRG), Ovide describes a vulnerability in TransUnion’s customer service hotline that allegedly allowed callers, with minimal identity proof, to reset passwords and change account contact information, potentially enabling account takeover and unauthorized access to credit report details. TransUnion reported that it updated protocols after being contacted, and PIRG later found that additional verification was requested in most retests.