Experian

Experian plc is a multinational data broker and consumer credit reporting company headquartered in Dublin, Ireland. It is listed on the London Stock Exchange and is a constituent of the FTSE 100 Index. Experian is a partner in USPS address validation. It is one of the "Big Three" alongside TransUnion and Equifax.

In addition to its credit services, Experian also sells decision analytic and marketing assistance to businesses, including individual fingerprinting and targeting. Like all credit reporting agencies, the company is required by U.S. law to provide consumers with one free credit report every year.

History

The company has its origins in Credit Data Corporation, a business which was acquired by TRW Inc. in 1968, and subsequently renamed TRW Information Services.

In November 1996, TRW sold the unit, as Experian, to Bain Capital and Thomas H. Lee Partners. Just one month later, the two firms sold Experian to The Great Universal Stores Limited in Manchester, England, a retail conglomerate with millions of customers paying for goods on credit (later renamed GUS). GUS merged its own credit-information business, CCN, which at the time was the largest credit-service company in the UK, into Experian.

In October 2006, Experian was demerged from GUS and listed on the London Stock Exchange.

In August 2005, Experian accepted a settlement with the Federal Trade Commission (FTC) over charges that Experian had violated a previous settlement with the FTC. The FTC alleged that ads for the "free credit report" did not adequately disclose that Experian customers would automatically be enrolled in Experian's $79.95 credit-monitoring program.

In January 2008, Experian announced that it would cut more than 200 jobs at its Nottingham office.

Experian shut down its Canadian operations on 14 April 2009.

In March 2017, the U.S. Consumer Financial Protection Bureau fined Experian $3 million for providing invalid credit scores to consumers.

In October 2017, Experian acquired Clarity Services, a credit bureau specialising in alternative consumer data.

In October 2024, Experian agreed to acquire Brazilian digital fraud prevention provider ClearSale for $350 million.

In October 2025, Experian shut down its Dutch operations after receiving a €2.7 million fine from the Dutch Data Protection Authority for illegally processing credit reference data on Dutch consumers.

Operations

In the United States, like the other major credit reporting bureaus, Experian is chiefly regulated by the Fair Credit Reporting Act (FCRA). The Fair and Accurate Credit Transactions Act of 2003, signed into law in 2003, amended the FCRA to require the credit reporting companies to provide consumers with one free copy of their credit report per 12-month period. Like its main competitors, TransUnion and Equifax, Experian markets credit reports directly to consumers. Experian heavily markets its for-profit credit reporting service, FreeCreditReport.com, and all three agencies have been criticised and even sued for selling credit reports that can be obtained at no cost.

Its market segmentation tool, Mosaic, is used by political parties to identify groups of voters. In the British version there are 15 main groups, broken down into 89 hyperspecific categories, from "corporate chieftains" to "golden empty-nesters" which can be taken down to the level of individual postcodes. It was first used by the Labour Party, but then taken up by the Conservatives in the 2015 General Election campaign.

Sales to identity thieves

In 2013 a Vietnamese national, Hieu Minh Ngo, was charged by the U.S. Department of Justice with attempting to sell personally identifiable information on hundreds of thousands of U.S. residents. This information had been allegedly purchased from Experian subsidiary and data aggregator Court Ventures. However, Ngo testified under oath that the information he had sold to identity thieves had actually been acquired from another hacker based in Russia, and not Experian or Court Ventures. Ngo then resold the information he acquired from the Russian hacker through the identity fraud enabling websites Superget.info and Findget.me. The information offered for anonymous sale on these websites included individual's name, address, Social Security number, date of birth, place of work, duration of work, state driver's licence number, mother's maiden name, bank account number(s), bank routing number(s), email account(s) and other account passwords.

Data breaches

2015

File:2015-10-05 experian-letter-redacted.jpg

Letter from Experian North America CEO, Craig Boundy, informing TTemplate:Non breaking hyphenMobile customer their personal information was compromised in Experian server hack.

On 1 October 2015 Experian announced that they had discovered a data breach existing between 1 September 2013 and 16 September 2015. As many as 15 million people who used the company's services, among them customers of American cellular company T-Mobile who had applied for Experian credit checks, may have had their private information exposed.

2020

In 2020 it was revealed that Experian had suffered a further data breach, on this occasion in South Africa. Initially, Experian claimed that the incident had been contained but subsequently this was shown to be untrue. Data on 24 million South Africans was leaked, as well as on nearly 800,000 businesses. Of these, 24,838 had financial details leaked.

2021

In January 2021 a new leak was revealed in Brazil, with the source being linked to Experian's Brazilian subsidiary Serasa Experian. The breach resulted in data of 220 million citizens (including some already dead) being sold in the web. This is probably the most severe data breach in history, as it includes names, social security numbers, income tax declaration forms, addresses and other private information on nearly all Brazilian citizens. Experian claims there's no evidence that its systems have been compromised, but this lack of evidence doesn't explain it being the only probable source for the data. According to a Brazilian consumer rights foundation, the company has not been handling the breach appropriately.

2022

In late 2022 a flaw was revealed in Experian's website which allowed access to individual credit reports without full authentication, simply by changing the last part of the URL being requested from "/acr/oow/" to "/acr/report". The flaw was fixed in early 2023, but it was not known how much data had been stolen through this security weakness.

See also

• Compuscan
• Credit bureau
• Intelliscore

External links

• Template:OpenCorp