The credit reporting firm did not name the third-party application involved in the incident, only noting that it was used for its US consumer support operations.