> I am completely sure TransUnion could have detected and foiled this incredibly obvious attack. I'm also completely sure they could have identified other victims of the same attackers and informed them, but they chose not to.

It's entirely possible that nobody at TransUnion knows how to achieve this given the state of their databases' and/or staff. For example, maybe their system was set up before constraints were a thing and they stopped development once it started printing money, so the only person "working" on it does light maintenance as a portion of their other duties.