Six in 10 Organizations Experienced at Least One Material Cyberattack in the Past 18 Months

New Forrester research for TransUnion highlights frequent material cyber impacts and major gaps in incident response partners and planning.

Rhea-AI Summary

TransUnion (TRU) released commissioned research showing that 60% of surveyed organizations experienced at least one material cyberattack impact in the past 18 months.

The Forrester Consulting study of 327 U.S. director-level and above incident response decision-makers found 40% lack an end-to-end incident response partner and 37% have no comprehensive incident response plan. While more than 70% already use at least one external provider, only 46% rate their current provider as delivering end-to-end readiness and response very or extremely well, and 41% plan to reevaluate providers within 12 months.

Market Context

TRU closed down 2.79% before publication, while all five listed peers also declined, including FDS a...

Analysis

TRU closed down 2.79% before publication, while all five listed peers also declined, including FDS at 4.52%. The aligned pre-headline weakness provided market context for the study release but did not establish a company-specific reaction.

Key Figures

Organizations with material cyberattack impact: 60% Survey respondents: 327 decision-makers Organizations lacking an end-to-end partner: 40% +5 more

Organizations with material cyberattack impact

60%

Past 18 months

Survey respondents

327 decision-makers

Director-level and above, United States

Organizations lacking an end-to-end partner

40%

Incident response survey

Organizations lacking a comprehensive plan

37%

Incident response survey

Support rated very important or mission-critical

76%

Partner selection criteria

Organizations using an external provider

More than 70%

Incident response survey

Providers rated very or extremely well

46%

Current provider performance

Organizations planning provider reevaluation

41%

Next 12 months

Key Terms

incident response, tabletop exercises

2 terms

incident response technical

"organizations’ incident response strategy"

Incident response is the organized process a company uses to detect, investigate, contain and recover from a security breach, data loss, operational outage or other urgent problem. For investors, it shows how quickly a firm can limit financial and reputational damage, restore normal operations and meet legal or disclosure duties — like an emergency crew that protects a building’s value and occupants when a fire breaks out.

tabletop exercises technical

"Organize cross-functional incident tabletop exercises"

A tabletop exercise is a structured, discussion-based simulation where company leaders and relevant teams walk through a hypothetical emergency, cyberattack, regulatory problem, or business disruption around a table rather than running real operations. It matters to investors because these rehearsals reveal practical gaps in plans, coordination or decision-making—similar to a dress rehearsal—which helps assess how prepared a company is to protect assets, maintain operations and preserve value under stress.

AI-generated analysis. How Rhea-AI works. Not financial advice.

See more from StockTitan in Google Search and AI answers. Adds StockTitan as a preferred source · opens Google

Add on Google Not now

New research commissioned by TransUnion highlights organizations’ incident response vulnerabilities

CHICAGO, Sept. 09, 2026 (GLOBE NEWSWIRE) -- Cyberattacks are becoming more frequent, disruptive and difficult for organizations to remediate quickly. In the past 18 months, 60% of organizations experienced at least one material impact, according to a commissioned study conducted by Forrester Consulting on behalf of TransUnion (NYSE: TRU).

The research, based on a survey of 327 director-level and above decision-makers who influence or make decisions on incident response strategy, found 40% said their organization lacks an end-to-end incident response partner, while 37% said they do not have a comprehensive incident response plan in place. The full findings will be discussed in the upcoming webinar, Close the Incident Response Gap: How to Strengthen Readiness, Recovery and Trust, on September 22.

“The aftermath of a cyberattack is very chaotic and complex, and most businesses cannot adequately prepare for it on their own,” said Matt Cullina, head of TransUnion’s global cyber insurance business, which helps organizations minimize harm and restore consumer confidence. “Having the right partner can help minimize the damage and get businesses back to normal much faster.”

The study found organizations recognize the need for comprehensive support from expert partners. Three in four respondents (76%) indicated that end-to-end incident response readiness and response support are either “very important” or “mission-critical” when selecting a partner.

In addition, more than 70% of respondents said their organization already uses at least one external incident response provider. However, only 46% said their current provider delivers that capability very well or extremely well, which explains why 41% plan to reevaluate their external incident response providers in the next 12 months.

One of the biggest barriers to adequate incident response support is the cost of retaining outside expertise, especially for midmarket and below organizations with smaller budgets. The study provides several recommendations for maximizing the investment, including:

• Utilize retainer time for proactive readiness preparation. This may include conducting initial readiness assessments and internal first responder training to familiarize team members with their roles and basic protocols.
  
  
• Organize cross-functional incident tabletop exercises and realistic crisis simulations to stress test and refine the incident response team’s capabilities. These should involve executive leadership, legal, communications, operations, and other key stakeholders.
  
  
• Prepare external breach communications to customers, partners and employees in advance of an incident. Involve privacy counsel, public relations and HR to hone messaging and have it approved and ready to deploy. While there will be gaps for details specific to each incident, the core messages communicating diligence in resolving the issue and restoring trust will be the same.
  
  
• After exercises or incidents, update plans and playbooks with lessons learned. Periodically reassess external incident response providers to ensure their capabilities and support remain aligned with evolving risks and business needs.
  
  

“Incident response should be treated as a continuous readiness cycle, not a one-time plan,” added Cullina. “The organizations best positioned to withstand cyber events are those that test their playbooks, include legal, communications and executive stakeholders in tabletop exercises, and continually reevaluate whether their providers can meet today’s threat environment.”

TransUnion incident response solutions help organizations build readiness and move from uncertainty to action. With over 15 years of industry expertise, TransUnion provides flexible services that coordinate responses, reduce disruptions, and support affected individuals. Click here to learn more.

About the study 
In this study, Forrester conducted an online survey of 327 director-level and above decision-makers in the United States who influence or make decisions on their organization’s incident response strategy and partner selection. Respondents represented enterprise and midmarket organizations across energy and utilities, financial services, healthcare, insurance, retail and telecommunications services. The study began in February 2026 and was completed in March 2026.

About TransUnion (NYSE: TRU)
TransUnion is a global information and insights company with over 13,000 associates operating in more than 30 countries. We make trust possible by ensuring each person is reliably represented in the marketplace. We do this with a Tru™ picture of each person: an actionable view of consumers, stewarded with care. Through our acquisitions and technology investments we have developed innovative solutions that extend beyond our strong foundation in core credit into areas such as marketing, fraud, risk and advanced analytics. As a result, consumers and businesses can transact with confidence and achieve great things. We call this Information for Good^® — and it leads to economic opportunity, great experiences and personal empowerment for millions of people around the world. http://www.transunion.com/business

Contact	Dave Blumberg
	TransUnion
E-mail	david.blumberg@transunion.com
Telephone	312-972-6646

FAQ

What types of organizations were included in the TransUnion-commissioned incident response study?

The online survey covered 327 director-level and above decision-makers in the United States who influence or make decisions on incident response strategy and partner selection. Respondents came from enterprise and midmarket organizations across energy and utilities, financial services, healthcare, insurance, retail and telecommunications services.

When was the incident response study for TransUnion conducted?

The study began in February 2026 and was completed in March 2026.