Experian controversies
Controversies tied to this brand in public sources. A listing is not a finding of fault.
Back to profile14 entries
2026
BCD Travel data breach disclosure
Issue disclosure
BCD Travel notified affected individuals of a security incident involving a third-party vulnerability that compromised personal information held in an application. The release reports that coverage estimated about 700,000 customers' data was exposed; BCD Travel said it had not identified evidence that the affected information had been misused.
Company response
Investigation — BCD Travel
launched an in-depth investigation with third-party cybersecurity and forensic experts
Remediation — BCD Travel
implemented recommended security measures
Remediation — BCD Travel
BCD Travel is offering affected individuals one year of complimentary credit and identity fraud monitoring through Experian
Source excerpt
has notified affected individuals of a data security incident involving a third-party vulnerability that compromised personal information held in one of its applications.
The incident has drawn public attention after the threat-actor group ShinyHunters claimed responsibility in late May 2026 and threatened to leak more than 700,000 records unless the company met its demands.
News coverage reports that the breach exposed personal data belonging to about 700,000 customers.
2022
Credit-report authentication vulnerability
A flaw in an Experian website reportedly permitted access to credit reports through manipulation of a URL after incomplete authentication. The issue was fixed in early 2023, but the cited material does not establish how much information was accessed.
2021
Brazilian data-leak controversy
A very large dataset involving Brazilian citizens was offered online and linked in reporting to Serasa Experian. Experian stated that there was no evidence its systems had been compromised, while consumer advocates criticized the response and the handling of the incident.
2021
CNA reports customer data breach following ransomware attack
Issue disclosure
CNA notified customers of a data breach following a ransomware attack on its systems. The breach affected 75,349 individuals, and the stolen files included personal information such as names and Social Security numbers. CNA said it found no evidence that the stolen information was viewed, retained, or shared.
Company response
Remediation — CNA
CNA will be offering 24 months of complimentary credit monitoring and fraud protection services through Experian.
Source excerpt
The data breach reported by CNA affected 75,349 individuals, according to breach information filed with the office of Maine's Attorney General.
CNA will be offering 24 months of complimentary credit monitoring and fraud protection services through Experian.
CNA Financial Corporation, a leading US-based insurance company, is notifying customers of a data breach following a Phoenix CryptoLocker ransomware attack that hit its systems in March.
2021
Guess notifies customers of data breach
Issue disclosure
Guess began notifying affected customers on June 9 about a data breach following a February ransomware attack. The company said personal information may have been accessed or acquired by an unauthorized actor.
Company response
Investigation — Guess
A cybersecurity forensic firm was engaged to assist with the investigation
Remediation — Guess
Guess has implemented additional measures to boost its security protocols
Refund or compensation — Guess
Guess began mailing breach notification letters to affected customers on June 9, offering complimentary identity theft protection services and one year of free credit monitoring through Experian to all impacted individuals.
Source excerpt
American fashion brand and retailer Guess is notifying affected customers of a data breach following a February ransomware attack that led to data theft.
On May 26, 2021, the investigation determined that personal information related to certain individuals may have been accessed or acquired by an unauthorized actor.
Guess began mailing breach notification letters to affected customers on June 9, offering complimentary identity theft protection services and one year of free credit monitoring through Experian to all impacted individuals.
2020
South African data exposure
A South African incident exposed data relating to approximately 24 million individuals and nearly 800,000 businesses. Subsequent reporting challenged the initial characterization that the incident had been fully contained.
2020
GE discloses employee information exposure after service-provider breach
Issue disclosure
GE disclosed that an unauthorized party accessed a Canon Business Process Services employee email account containing documents about certain current and former GE employees and beneficiaries. The documents may have included personal and financial information. GE said its own systems were not affected; Canon offered affected individuals identity protection and credit monitoring.
Company response
Remediation — Canon
Canon is offering identity protection and credit monitoring services for two years at no cost through Experian.
Remediation — GE
GE has also set up a support hotline which affected individuals can call for more information on the incident.
Source excerpt
General Electric (GE) has revealed that one of its service providers has fallen victim to a data breach which resulted in the personally identifiable information of current and former employees as well as beneficiaries being exposed online.
According to the notice of data breach, GE's systems were not affected by Canon's security breach, though the company has indicated that it is taking preventative measures to prevent a similar incident from taking place in the future.
We were notified on February 28, 2020 that Canon had determined that, between approximately February 3 - 14, 2020, an unauthorized party gained access to an email account that contained documents of certain GE employees, former employees and beneficiaries entitled to benefits that were maintained on Canon’s systems.
2020
Experian updates on South African data breach investigation
Company response
Experian provided an update on its investigation into a data breach incident in South Africa. The company said it had identified files on the internet that it believes relate to the incident and was continuing to investigate them. Experian also confirmed that a criminal case had been opened against the suspected fraudster. The company did not disclose further details about the files or the case in this update.
Experian said it had identified files on the internet that it believes relate to the incident and was continuing to investigate them. The company also confirmed that a criminal case had been opened against the suspected fraudster.
Company response
Investigation — Experian
We continue to investigate these files and will take all steps available to us to reduce further dissemination if possible.
Source excerpt
In August, a fraudster was nabbed after managing to breach this information from Experian.
A criminal case was opened last week, and the matter is “now in the hands of law enforcement,” they confirmed
Experian said on Tuesday it had identified files they believe contain data relating to the incident on the internet.
2020
Experian South Africa discloses data breach
Issue disclosure
Experian's South African branch disclosed a data breach affecting the personal information of as many as 24 million South Africans and 793,749 business entities, according to a report cited in the article. Experian said consumer credit and financial information was not obtained and that it had identified the origin of the attack.
Experian’s South African branch disclosed a data breach affecting personal information of as many as 24 million South Africans and 793,749 business entities, according to a report cited in the article. Experian said consumer credit and financial information was not obtained and that it had identified the origin of the attack.
Company response
Investigation — Experian
The company declared that it has identified the origin of the attack
Remediation — Experian
has already wiped stolen data from the devices used by the attackers.
Apology — Experian
I would like to apologise for the inconvenience caused to any affected parties.
Source excerpt
The company declared that it has identified the origin of the attack and has already wiped stolen data from the devices used by the attackers.
The South African branch of consumer credit reporting agency Experian disclosed a data breach that impacted 24 million customers.
“Experian – a consumer, business and credit information services agency – has experienced a breach of data which has exposed some personal information of as many as 24 million South Africans and 793 749 business entities to a suspected fraudster.”
2020
Experian South Africa confirms breach exposing customer records
Issue disclosure
In August 2020, Experian South Africa confirmed a security breach that exposed customer records. According to the company, it was investigating a fraudulent data inquiry. It stated that the misappropriated data had been secured and deleted, and that it had notified the relevant regulators. The confirmation addressed the exposure of customer records and the company's response steps: investigating the fraudulent inquiry, securing and deleting the misappropriated data, and notifying regulators.
Company response
Investigation — Experian
The company is investigating what it is calling an “isolated incident in South Africa involving a fraudulent data inquiry”.
Remediation — Experian
The misappropriated data has been secured and deleted, the company states.
Ongoing disclosure — Experian
Experian has notified the National Credit Regulator and the Information Regulator of the incident
Apology — Experian
I would like to apologise for the inconvenience caused to any affected parties.
Source excerpt
Consumer, business and credit information services agency Experian South Africa has confirmed that it has suffered a security breach that has exposed customer records.
The breach is thought to have exposed some personal information of as many as 24-million South Africans and 793 749 business entities to a suspected fraudster.
2019
Wawa discloses payment-card data breach
Issue disclosure
Wawa disclosed that malware found on its payment-processing systems may have exposed customer payment-card information. The company said the malware had been contained as of Dec. 12. CEO Chris Gheysens apologized, and Wawa offered potentially affected customers one year of identity-theft protection and credit monitoring.
Company response
Apology — Wawa
"I apologize deeply to all of you, our friends and neighbors, for this incident," Gheysens said.
Remediation — Wawa
The company has committed to providing identity theft protection and credit monitoring for one year through Experian to those who may be affected by the Wawa data breach.
Source excerpt
Investigators determined customer information may have been exposed from March 4 to Dec. 12 from payment cards used at cashier terminals and fuel pumps.
"I apologize deeply to all of you, our friends and neighbors, for this incident," Gheysens said.
Wawa found malware on its payment processing systems Dec. 10, according to a statement the company issued Thursday.
2017
Penalty over invalid credit scores
The CFPB fined Experian $3 million after finding that consumers had received credit scores that were not valid scores generated by the model represented to them.
2015
Breach involving T-Mobile credit applicants
Experian disclosed unauthorized access spanning 2013 to 2015. Information connected with as many as 15 million people who applied for T-Mobile credit checks may have been exposed.
2005
Free-credit-report advertising settlement
The FTC alleged that Experian's advertising for free credit reports did not adequately disclose automatic enrollment in a paid credit-monitoring program. Experian accepted a settlement.