TransUnion (TRU) Risk Factors

Our success depends, in part, on our ability to protect and preserve the proprietary aspects of our technology and services. If we are unable to protect our intellectual property, including trade secrets and other unpatented intellectual property, our competitors could use our intellectual property to market and deliver similar services, decreasing the demand for our services. We rely on the patent, copyright, trademark, trade secret and other intellectual property laws of the United States and other countries, as well as contractual restrictions, such as nondisclosure agreements, to protect and control access to our proprietary intellectual property. These measures afford limited protection, however, and may be inadequate. We may be unable to prevent third parties from using our proprietary assets without our authorization or from breaching any contractual restrictions with us. Enforcing our rights could be costly, time-consuming, distracting and harmful to significant business relationships. Claims that a third party illegally obtained and is using trade secrets can be difficult to prove, and courts outside the United States may be less willing to protect trade secrets. Additionally, others may independently develop non-infringing technologies that are similar or superior to ours. Any significant failure or inability to adequately protect and control our proprietary assets may harm our business and reduce our ability to compete.

As a global consumer credit reporting agency and provider of risk and information solutions, we collect, store and transmit a large amount of sensitive and confidential consumer information on over one billion consumers, including financial information, personally identifiable information and protected health information. We also rely heavily on computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business. We face significant and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our systems and data including unintentional events and deliberate attacks by third parties or insiders, such as the exploitation of "bugs" or security vulnerabilities in software and hardware and sophisticated attack methods such as ransomware. These cyberattacks can take many forms, but they typically have one or more of the following objectives, among others: - obtain unauthorized access to confidential data such as personal information;- manipulate or destroy data;- disrupt, sabotage or degrade service on our systems; or - affect our operations or data through attacks on third-party business partners or service providers. We experience numerous attempts to access our computer systems, software, networks, data and other technology assets on a daily basis. We have also experienced cyberattacks and other security incidents, and expect that such attacks and incidents will continue in varying degrees in the future. To date, none of these attacks or incidents has had a material impact on our business, operations or financial results. However, there can be no assurance that future attacks will be immaterial and even immaterial incidents may adversely impact us. For example, in March 2022, a criminal third party obtained access to a TransUnion South Africa server and certain customer personally identifiable information through misuse of an authorized client's credentials. We promptly initiated our response processes, implemented technical containment measures, engaged cybersecurity and forensic experts and launched an investigation. As a precautionary measure, TransUnion South Africa temporarily took certain elements of our services offline, all of which have been resumed. The security and protection of non-public consumer information is TransUnion's top priority. However, there can be no assurance that our cybersecurity risk management program and processes, including our controls, will be fully implemented, complied with or effective. We cannot assure you that our systems, databases and services will not be compromised or disrupted in the future, whether as a result of deliberate attacks by malicious actors, breaches due to employee error or malfeasance, or other disruptions during the process of upgrading or replacing computer software or hardware, power outages, computer viruses, telecommunication or utility failures or natural disasters or other catastrophic events. Further, it is possible that we may acquire a company that has experienced a security incident or has security vulnerabilities that the acquired company has yet to discover, investigate and remediate. While we execute security due diligence in these transactions, it is possible that neither the acquired company nor TransUnion may identify these issues in a timely manner, which could spread more broadly to other parts of TransUnion during the integration effort. Highly publicized cybersecurity incidents, including the data incident announced by Equifax on September 7, 2017, and more recently, the December 13, 2020 announcement by SolarWinds that its software supply chain was compromised, have heightened consumer, legislative and regulatory awareness of cybersecurity risks. These events continue to embolden individuals or groups to target our systems more aggressively. The preventive actions we take to address cybersecurity risk, including protection of our systems and networks, may be insufficient to repel or mitigate the effects of cyberattacks in the future as it may not always be possible to anticipate, detect or recognize threats to our systems, or to implement effective preventive measures against all cybersecurity risks. This is because, among other things: - the techniques used in cyberattacks change frequently and are increasingly sophisticated (including due to attacker's use of artificial intelligence), and may not be recognized until after the attacks have succeeded;- cyberattacks can originate from a wide variety of sources, including sophisticated threat actors involved in organized crime, sponsored by nation-states, or linked to terrorist or hacktivist organizations; and - third parties may seek to gain access to our systems either directly or using equipment or security passwords belonging to employees, customers, third-party service providers or other users (such as through social engineering and phishing attacks). Unauthorized disclosure, loss or corruption of our data or inability of our customers to access our systems could disrupt our operations, subject us to substantial regulatory and legal proceedings (including class actions) and potential liability, result in a material loss of business and/or significantly harm our reputation. We may not be able to timely address the consequences of a cybersecurity incident because a successful breach of our computer systems, software, networks or other technology assets could occur and persist for an extended period of time before being detected due to, among other things: - the breadth and complexity of our operations and the high volume of transactions that we process;- the large number of customers, counterparties and third-party service providers with which we do business;- the proliferation and increasing sophistication of cyberattacks;- the possibility that a malicious third party compromises the software, hardware or services that we procure from a service provider unbeknownst to both the provider and to TransUnion; and - the possibility that a third party, after establishing a foothold on an internal network without being detected, might obtain access to other networks and systems. The extent of a particular cybersecurity incident and the steps that we may need to take to investigate it may not be immediately clear, and it may take a significant amount of time before such an investigation can be completed and full and reliable information about the incident is known. While such an investigation is ongoing, we may not necessarily know the extent of the harm or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, any or all of which could further increase the costs and consequences of a cybersecurity incident. Due to concerns about data security and integrity, a growing number of legislative and regulatory bodies around the world have adopted consumer notification and other requirements in the event that consumer information is accessed by unauthorized persons and additional regulations regarding the use, access, accuracy and security of such data are possible. For example, in the United States, we are subject to federal and state laws that provide for more than 50 disparate notification regimes, some of which also provide for statutory damages and private rights of action for plaintiffs who experience certain types of data breaches. In the event of unauthorized access, our failure to comply with the complexities of these various regulations could subject us to regulatory scrutiny and additional liability.

In our markets, there are continuous improvements in computer hardware, network operating systems, programming tools, programming languages, operating systems, data matching, data filtering and other database technologies and the use of the internet. These improvements, as well as changes in customer preferences or regulatory requirements, may require changes in the technology used to gather and process our data and deliver our services. Our future success will depend, in part, upon our ability to: - internally develop and implement new and competitive technologies;- use leading third-party technologies effectively;- respond to changing customer needs and regulatory requirements, including being able to bring our new products to the market quickly; and - transition customers and data sources successfully to new interfaces or other technologies. We cannot provide assurance that we will successfully implement new technologies, cause customers or data furnishers to implement compatible technologies or adapt our technology to evolving customer, regulatory and competitive requirements. If we fail to respond, or fail to cause our customers or data furnishers to respond, to changes in technology, regulatory requirements or customer preferences, the demand for our services, the delivery of our services or our market reputation could be adversely affected. Additionally, our failure to implement important updates could affect our ability to successfully meet the timeline for us to generate cost savings resulting from our investments in improved technology. Failure to achieve any of these objectives would impede our ability to deliver strong financial results.

Our businesses are subject to regulation under the FCRA, the GLBA, the DPPA, HIPAA, HITECH, the Dodd-Frank Act, the FTC Act and various other international, federal, state and local laws and regulations. See "Business-Legal and Regulatory Matters" for a description of select regulatory regimes to which we are subject. These laws and regulations, which generally are designed to protect the privacy of the public and to prevent the misuse of personal information available in the marketplace, are complex, change frequently and have tended to become more stringent over time. We already incur significant expenses to ensure compliance with these laws. Currently, public concern is high with regard to the operation of consumer reporting agencies in the United States, as well as the collection, use, accuracy, correction and sharing of personal information, including Social Security numbers, dates of birth, financial information, medical information, department of motor vehicle data and other personal data. In addition, many consumer advocates, privacy advocates, legislatures and government regulators believe that existing laws and regulations do not adequately protect privacy and have become increasingly concerned with the collection and use of this type of personal information. As a result, thirteen U.S. states have passed comprehensive privacy legislation intended to provide consumers with greater transparency and control over their personal information by providing consumers with certain rights, such as the right to know what personal information is being collected about them, and the right to access, delete, correct, or opt out of the sale of their personal information. The original California Consumer Privacy Act became effective in 2020, with amendments in the California Privacy Rights Act effective in 2023. Similar laws in Colorado, Connecticut, Utah and Virginia became effective over the course of 2023. Similar laws in Delaware, Indiana, Iowa, Montana, Oregon, New Jersey, Tennessee, and Texas take effect over the course of 2024 to 2026. While these laws include specific exemptions for practices and activities regulated by FCRA, GLBA, HIPAA and DPPA, including our credit reporting business, they apply to other portions of our business that are not regulated by these laws. Public concern regarding identity theft also has led to more transparency for consumers as to what is in their credit reports. We provide credit reports and scores and monitoring services to consumers for a fee, and this income stream could be reduced or restricted by legislation that requires us to provide these services to consumers free of charge. For example, under U.S. federal law today, we are required to provide consumers with one credit report per year free of charge, and beginning in April 2020, we began offering consumers free weekly credit reports. The following legal and regulatory developments also could have a material adverse effect on our business, financial condition or results of operations: - amendment, enactment or interpretation of laws and regulations that restrict the access and use of personal information and reduce the availability or effectiveness of our solutions or the supply of data available to customers;- changes in governmental, cultural and consumer attitudes in favor of further restrictions on information collection and sharing, which may lead to regulations that prevent full utilization of our solutions;- failure of data suppliers or customers to comply with laws or regulations, where mutual compliance is required;- failure of our solutions to comply with current laws and regulations; and - failure of our solutions to adapt to changes in the regulatory environment in an efficient, cost-effective manner. Changes in applicable legislation or regulations that restrict or dictate how we collect, maintain, combine and disseminate information, or that require us to provide services to consumers or a segment of consumers without charge, could adversely affect our business, financial condition or results of operations. Evolutions in consumer finance regulatory requirements or market practices involving our customers also might negatively affect our businesses and the markets into which we sell. For instance, the Federal Housing Finance Agency and various government sponsored entities continue to evaluate permitting mortgage originators to underwrite loans using only two credit reports, rather than the current mandate to use a credit report from each of the three national consumer reporting agencies. In the future, we may be subject to significant additional expense to ensure continued compliance with applicable laws and regulations and to investigate, defend or remedy actual or alleged violations. Any failure by us to comply with applicable laws or regulations could also result in significant liability to us, including liability to private plaintiffs as a result of individual or class action litigation, or may result in the cessation of our operations or portions of our operations or impositions of fines and restrictions on our ability to carry on or expand our operations. Moreover, our compliance with privacy laws and regulations and our reputation depend in part on our customers' adherence to privacy laws and regulations and their use of our services in ways consistent with consumer expectations and regulatory requirements. Certain of the laws and regulations governing our business are subject to interpretation by judges, juries and administrative entities, creating substantial uncertainty for our business. We cannot predict what effect the interpretation of existing or new laws or regulations may have on our business. See "Business-Legal and Regulatory Matters."

The defensive measures that we take to manage threats, especially cyber-related threats, to our business may not adequately anticipate, prevent or mitigate harm we may suffer from such threats. Criminals use evolving and increasingly sophisticated methods of perpetrating illegal and fraudulent activities. For example, in September 2020, TransUnion experienced a series of Distributed Denial of Service ("DDoS") attacks. While these attacks did not result in any unauthorized access to data or systems, there was disruption to TransUnion's normal operations including degraded customer response time, intermittent timeouts and degraded internal information technology services utilized by TransUnion associates. TransUnion deploys a number of defensive measures to mitigate DDoS attacks, but persistent attackers can challenge these protections. Also, in July 2019, TransUnion Limited, a Hong Kong entity in which the Company holds a majority interest, was a victim of a fraud incident that occurred in July 2019 in our Asia Pacific region involving employee impersonation and fraudulent requests that successfully targeted TransUnion Limited, which resulted in a series of fraudulently induced wire transfers totaling $17.8 million, a portion of which has been subsequently recovered. Fraudulent activities committed against us could disrupt our operations, have an adverse effect on our financial results, subject us to substantial legal proceedings and potential liability, result in a material loss of business and/or significantly harm our reputation.

Public and commercial sources of free or relatively inexpensive consumer information have become increasingly available and this trend is expected to continue. Public and commercial sources of free or relatively inexpensive consumer information, including free credit information from lead generation companies and from banks, may reduce demand for our services. Beginning in April 2020, we began offering free credit reports on a weekly basis. To the extent that our customers choose not to obtain services from us and instead rely on information obtained at little or no cost from these public and commercial sources, our business, financial condition and results of operations may be adversely affected.

Over the last several years, we have derived a growing portion of our revenues from customers outside the United States, and it is our intent to continue to expand our international operations. We have sales and technical support personnel in numerous countries worldwide. We expect to continue to add personnel internationally to expand our abilities to deliver differentiated services to our international customers. Expansion into international markets will require significant resources and management attention and will subject us to new regulatory, economic and political risks. Moreover, the services we offer in developed and emerging markets must match our customers' demand for those services. Due to price, limited purchasing power and differences in the development of consumer credit markets, there can be no assurance that our services will be accepted in any particular developed or emerging market, and we cannot be sure that our international expansion efforts will be successful. The results of our operations and our growth rate could be adversely affected by a variety of factors arising out of international commerce, some of which are beyond our control. These factors include: - currency exchange rate fluctuations;- foreign exchange controls that might prevent us from repatriating cash to the United States;- difficulties in managing and staffing international offices;- increased travel, infrastructure, legal and compliance costs of multiple international locations;- foreign laws and regulatory requirements;- terrorist activity, natural disasters and other catastrophic events;- restrictions on the import and export of technologies;- difficulties in enforcing contracts and collecting accounts receivable;- longer payment cycles;- failure to meet quality standards for outsourced work;- unfavorable tax rules;- political and economic conditions in foreign countries, particularly in emerging markets;- the presence and acceptance of varying level of business corruption in international markets;- varying business practices in foreign countries; and - reduced protection for intellectual property rights. For example, in 2023, reported revenue from our International segment increased 9.2% including the impact of foreign currencies, or 12.2% on a constant currency basis which excludes the impact of foreign currencies. See "Management's Discussion and Analysis of Financial Condition and Results of Operations-Twelve Months Ended December 31, 2023, 2022 and 2021-Revenue-International Segment." As we continue to expand our business, our success will partially depend on our ability to anticipate and effectively manage these and other risks. Our failure to manage these risks could adversely affect our business, financial condition and results of operations.

We face various risks related to health epidemics, pandemics and similar outbreaks. For example, the COVID-19 pandemic and the mitigation efforts by governments to attempt to control its spread adversely impacted the global economy, leading to reduced consumer spending and lending activities. Our customers, and therefore our business and revenues, are sensitive to negative changes in general economic conditions. Any new pandemic or other public health crises, or future public health crises, could have a material impact on our business, financial condition and results of operations going forward.