TransUnion (TRU) Risk Analysis

There has been substantial litigation in the United States regarding intellectual property rights in the information technology industry. We cannot be certain that we do not infringe on the intellectual property rights of third parties, including the intellectual property rights of third parties in other countries, which could result in a liability to us. Historically, patent applications in the United States and some foreign countries have not been publicly disclosed until eighteen months following submission of the patent application, and we may not be aware of currently filed patent applications that relate to our products or processes. If patents are later issued on these applications, we may be liable for infringement. In the event that claims are asserted against us, we may be required to obtain licenses from third parties (if available on acceptable terms or at all). Any such claims, regardless of merit, could be time consuming and expensive to litigate or settle, divert the attention of management and materially disrupt the conduct of our business, and we may not prevail. Intellectual property infringement claims against us could subject us to liability for damages and restrict us from providing services or require changes to certain products or services. Although our policy is to obtain licenses or other rights where necessary, we cannot provide assurance that we have obtained all required licenses or rights. If a successful claim of infringement is brought against us and we fail to develop non-infringing products or services, or to obtain licenses on a timely and cost-effective basis, our reputation, business, financial condition and results of operations could be adversely affected.

As a global consumer credit reporting agency and provider of risk and information solutions, we collect, store and transmit a large amount of sensitive and confidential consumer information on over one billion consumers, including financial information, personally identifiable information and protected health information. As such, we rely heavily on computer systems, hardware, software and technology infrastructure for both internal and external operations that are critical to our business. We face significant and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our systems and data including unintentional events and deliberate attacks by third parties or insiders, such as the exploitation of "bugs" or security vulnerabilities in software and hardware and sophisticated attack methods such as ransomware. Cyberattacks can take many forms, but they typically have one or more of the following objectives, among others: - obtain unauthorized access to confidential data such as personal information;- manipulate or destroy data;- disrupt, sabotage or degrade service on our systems; or - affect our operations or data through attacks on third-party business partners or service providers. We experience numerous attempts to access our computer systems, software, networks, data and other technology assets on a daily basis. We have also experienced cyberattacks and other security incidents, and expect that such attacks and incidents will continue in varying degrees in the future. To date, none of these attacks or incidents has had a material impact on our business, operations or financial results. However, there can be no assurance that future attacks will be immaterial and even immaterial incidents may adversely impact us. For example, in July 2025, TransUnion was affected by a cyberattack in which a third party gained unauthorized access through social engineering to a third-party application used in our customer support operations that exposed certain personal data of 4.4 million consumers. While this incident was not material to TransUnion and did not affect our core credit database or related credit report products and services, we have incurred and expect to continue incurring costs associated with, among other things, responding to regulatory inquiries and class action lawsuits. The security and protection of non-public consumer information is our top priority. However, there can be no guarantee that the cybersecurity risk management program and processes for any company, including us and our service providers, will be fully implemented, complied with and effective at all times. We cannot assure you that our systems, databases and services will not be compromised or disrupted in the future, whether as a result of deliberate attacks by malicious actors, breaches due to employee error or malfeasance, or other disruptions during the process of upgrading or replacing computer software or hardware, power outages, computer viruses, telecommunication or utility failures, or natural disasters or other catastrophic events. We have acquired, and may continue to acquire, companies with cybersecurity vulnerabilities and/or unsophisticated security measures, which exposes us to significant cybersecurity, operational, and financial risks. While we execute security due diligence in these transactions, neither the acquired company nor TransUnion can identify every issue in a timely manner, which could create material risk to us during the integration effort. Highly publicized cybersecurity incidents have heightened consumer, legislative and regulatory awareness of cybersecurity risks. These events continue to embolden individuals or groups to target our systems more aggressively. The preventive actions we take to address cybersecurity risk, including protection of our systems and networks, cannot sufficiently account for all threats or repel or mitigate the effects of all cyberattacks in the future as it is not possible to anticipate, detect or recognize all threats to our systems, or to implement comprehensive preventive measures against all cybersecurity risks. This is because, among other things: - the techniques used in cyberattacks change frequently and are increasingly sophisticated, including due to attackers' increasing use of AI, and may not be recognized until after the attacks have succeeded;- cyberattacks can originate from a wide variety of sources, including sophisticated threat actors involved in organized crime, sponsored by nation-states, or linked to terrorist or hacktivist organizations; or - third parties may seek to gain access to our systems either directly or using equipment or security passwords belonging to employees, customers, third-party service providers or other users (such as through social engineering and phishing attacks), similar to the tactics used in our cyber incident in July 2025. In addition, given the nature of complex systems and services like ours, we have a large and ever-growing global attack surface comprised of numerous interconnected components, each with their own vulnerabilities and risks. While we have many security tools that we deploy across our infrastructure that actively scan our products and identify and track security vulnerabilities, we are unable to comprehensively guarantee that we can apply patches or ensure measures are in place to mitigate all such vulnerabilities before vulnerabilities can be exploited by a threat actor. Unauthorized disclosure, loss or corruption of our data or inability of our customers to access our systems could materially disrupt our operations, subject us to substantial regulatory and legal proceedings (including class actions) and liability (such as penalties, fines and required changes to business practices), result in a material loss of business and/or significantly harm our reputation and competitiveness. We may not be able to timely address the consequences of a cybersecurity incident because a successful breach of our computer systems, software, networks or other technology assets could persist for an extended period of time before being detected due to, among other things: - the breadth and complexity of our operations and the high volume of transactions that we process;- the large number of customers, counterparties and third-party service providers with which we do business;- the proliferation and increasing sophistication of cyberattacks;- the possibility that a malicious third party compromises the software, hardware or services that we procure from a service provider unbeknownst to both the provider and to TransUnion; or - the possibility that a third party, after establishing a foothold on an internal network without being detected, might obtain access to other networks and systems. The extent of a particular cybersecurity incident and the steps that we may need to take to investigate it may not be immediately clear, and it may take a significant amount of time before such an investigation can be completed and full and reliable information about the incident is known. While such an investigation is ongoing, we may not necessarily know the extent of the harm or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, any or all of which could further increase the costs and consequences of a cybersecurity incident. Due to concerns about data security and integrity, a growing number of legislative and regulatory bodies around the world have adopted consumer notification, public disclosure and other requirements in the event that consumer information is accessed by unauthorized persons and additional regulations regarding the use, access, accuracy and security of such data are possible. For example, in the United States alone, we are subject to federal and state laws that provide for more than 50 disparate notification regimes, some of which also provide for statutory damages and private rights of action for plaintiffs who experience certain types of data breaches. Jurisdictions outside the U.S., including in Europe, have strict notification and reporting requirements that are time sensitive and subject to large penalty provisions. Any failure to comply with the complexities of these various global regulations could subject us to regulatory scrutiny and substantial liability.

Our ability to provide reliable service largely depends on our ability to maintain the efficient and uninterrupted operation of our computer network, systems and data centers, some of which have been outsourced to third-party providers. In addition, we generate a significant amount of our revenues through channels that are dependent on links to telecommunications providers. Our systems, personnel and operations could be exposed to damage or interruption from fire, natural disasters, pandemic illness, power loss, war, terrorist acts, civil disobedience, telecommunication failures, computer viruses, DDoS attacks or human error. We may not have sufficient redundant operations to cover a loss or failure of our systems in a timely manner. Any significant interruption could severely harm our business and reputation and result in a loss of revenue and customers. Additionally, from time to time we send our customers new releases of our distribution programs, some of which contain security updates. Any failure by our customers to install these new releases could expose our customers to computer security risks.

Regulatory guidance to financial institutions like national banks (e.g., from The Office of the Comptroller of the Currency's (the "OCC")) on assessing and managing risks associated with third-party relationships, which include all business arrangements between a bank and another entity, by contract or otherwise, requires banks to exercise comprehensive oversight throughout each phase of a bank's business arrangement with third-party service providers, and instructs banks to adopt risk management processes commensurate with the level of risk and complexity of its third-party relationships. The OCC and other regulators expect especially rigorous oversight of third-party relationships that involve certain "critical activities," which include significant bank functions or significant shared services or other activities that could have a major impact on a bank's operations. In light of this guidance, our existing or potential financial services customers subject to regulation may continue to revise their third-party risk management policies and processes and the terms on which they do business with us, which may adversely affect our relationship with such customers.

Our largest customers, and therefore our business and revenues, are influenced by macroeconomic conditions and are impacted by the availability of credit, the level and volatility of interest rates, inflation, employment levels, consumer confidence and housing demand. In addition, a significant amount of our revenue is concentrated among certain customers, industries, product offerings and in distinct geographic regions, primarily in the United States. Our 2025 revenue in our U.S. Markets Financial Services and Consumer Interactive verticals accounted for approximately 37% and 13%, respectively, of consolidated gross revenues, respectively. If businesses in these industries experience economic hardship, we cannot assure you that we will be able to generate future revenue growth. Our customer base suffers when financial markets experience volatility, liquidity issues and disruption, which has occurred in the past and which could reoccur, and the potential for increased and continuing disruptions going forward, present considerable risks to our business and revenue. Changes in the macroeconomic environment have resulted, and may continue to result, in fluctuations in volumes, pricing and operating margins for our services. In addition, if consumer demand for financial services and products and the number of credit applications decrease, the demand for our services could also be materially reduced. High inflation levels have a negative impact on our business by decreasing demand for credit due to slower consumer spending on non-essential goods and services and due to the Federal Reserve raising interest rates to combat inflation. Continued inflation and additional interest rate increases could further materially impact our business. These types of disruptions could lead to a decline in the volumes of services we provide our customers and could negatively impact our revenue and results of operations.

We conduct operations in over 30 countries and, in the fiscal year ended December 31, 2025, approximately 22% of our reported revenue was derived by our international operations based on where it was earned, which subjects us to various risks inherent in global operations. We may conduct business in additional foreign jurisdictions in the future, which may carry operational risks. At any particular time, our global operations may be affected by local changes in laws, regulations, and political and economic environments, including inflation, recession, currency volatility, and competition, as well as business and operational decisions made by joint venture partners. Furthermore, geopolitical dynamics caused by political, economic, social or other conditions in foreign countries and regions may impact our business and results of operations. Significantly higher and sustained rates of inflation, with subsequent increases in operational costs, could have a material adverse effect on our business, financial position and results of operations. The continued threat of terrorism and heightened security and military action in response thereto, or any other current or future acts of terrorism, war and other events (such as economic sanctions and trade restrictions) may cause further disruptions to the economies of the United States and other countries and create further uncertainties or could otherwise negatively impact our business, operating results, and financial condition. Changes or uncertainty in U.S. policies or policies in other countries and regions in which we do business, including any changes or uncertainty with respect to U.S. or international trade policies or tariffs, also can disrupt our global operations, as well as our customers and suppliers, in a particular location and may require us to spend more money to source certain products or materials that we purchase. Any of these factors could adversely affect our business, financial position, and results of operations.

We operate in numerous U.S. and international locations, and we have offices in a number of major cities across the globe. The occurrence of, or concerns related to, a major weather event, earthquake, hurricane, flood, drought, volcanic activity, disease or pandemic, or other natural disaster could significantly disrupt our operations. In addition, acts of civil unrest, failure of critical infrastructure, terrorism, war and armed conflict (including the ongoing conflicts in the Middle East, India, Ukraine and Russia), and abrupt political change, as well as responses by various governments and the international community to such acts, can have a negative effect on our business. Such events could impede delivery of our products and services to our clients, disrupt or shut down the internet or other critical client-facing and business processes, impede the travel of our personnel and clients, dislocate our critical internal functions and personnel, and in general harm our ability to conduct normal business operations, any of which can negatively impact our financial condition and operating results. Such events could also impact the business of our clients, which could materially adversely affect our business.