Now let's see if they care.
Transunion can't do shit about some Belarusian teenager stealing your identity any more than anybody can indict them for deploying ransomware on government networks. The framework for prosecution of international cybercrime does not exist.
Domestically, Transunion absolutely will shut down access to data furnishers who do not vet employees, in cases where an employee is bored and looking up their exes and random celebrities. It is a violation of the FCRA and subjects the bureau and the furnisher to fines. The bored employee scenario usually just results in termination but if there are other factors at play like identity theft/fraud, law enforcement absolutely gets involved.
This rogue employee scenario is the mechanic I'm guessing is being exploited here, only it seems crowdsourced to obfuscate attribution (so one person isn't making hundreds of fraudulent requests that gets them noticed).
This stuff happens at Equifax all the time too. People are always trying to look up Donald Trump, athletes and rappers in misguided attempts to see how much money they have or where they live. (Celebs have taken to getting around this by buying properties in relatives' names.)
I'm not sure what makes you think that, given you don't know any of the details involved.
In my case, TransUnion received credit checks for me with dates of birth 1 Jan, 2 Jan, 3 Jan, 4 Jan and so on until they hit upon my date of birth, then a credit account was opened that same day, then later in the day a third party credit monitoring agency accessed my credit report and they were allowed to pass 'knowledge based authentication' using their knowledge of that credit account.
I am completely sure TransUnion could have detected and foiled this incredibly obvious attack. I'm also completely sure they could have identified other victims of the same attackers and informed them, but they chose not to.
It's entirely possible that nobody at TransUnion knows how to achieve this given the state of their databases' and/or staff. For example, maybe their system was set up before constraints were a thing and they stopped development once it started printing money, so the only person "working" on it does light maintenance as a portion of their other duties.
They can but they don't. There being no framework for prosecution doesn't mean it's impossible to not hand out data to anybody that asks with minimal info provided.
The criminal made a false request for credit report. TU released the credit history without confirming ID. The bank relied on that credit report to extend credit.
The problem is, as a whole, ruining the credit of a few thousand people/year (and making them jump through hoops to regain their ID) is less costly than clamping down. TU absolutely contributes to the problem; they just have no incentive to fix it.
The notion that the fault would completely be on a "Belarusian teenager stealing your identity" and no responsibility whatsoever on people organising a system of massive private data collection in the first place, and then not even able to keep such data secure, is ludicrous. And even when you know that privacy invasion is attempted all the time you don't reach the conclusion that at the very least better securing the data would be needed, that task I'm not sure can be done by any "Belarusian teenager" - and that task has de-facto not be done by whoever is collecting and maintaining the private data that has leaked and is still leaking.
No they wouldn't. GDPR enforcement is severely lacking and the regulators tasked with enforcing it are either incompetent or corrupt.
I'm sure they would respond to a subpoena if you were willing to work with an attorney
This is categorically false.
I've had transunion hand my entire credit report over to hackers who had nothing but public information, and transunion absolutely do not give a shit.