Who Is CyberScout? The Breach Letter Offer, Explained

A woman in Ohio opened an envelope from a company called CyberScout. She had never heard of it. The letter said her records were in a breach at her heart-monitor company. It offered her two years of free credit monitoring, and a code to activate it.

So she did the sensible thing and did nothing. Answering mail from a company you cannot place is how people get robbed. Two years later the offer expired, unused.

Her instinct was right. Her outcome was still wrong. Who is CyberScout, and should you take what it is offering? Here are the answers, in the order the questions arrive.

Who is CyberScout? A breach-notification vendor, not the company that lost your data

Companies that suffer a breach rarely mail the letters themselves. Instead they hire a firm that does breach response for a living. That firm prints the notices, staffs the call center, and runs the identity-protection offer.

CyberScout is one of those firms. So are Kroll, Epiq, IDX and a few others. The vendor on your envelope is a contractor, so its name tells you nothing about whether the breach letter is real.

The branding shifts, too, because these firms keep buying each other. Sontiq acquired CyberScout, and then TransUnion acquired Sontiq in 2021. So one letter says CyberScout, the next says IdentityForce, and a third says TransUnion. All three can mean roughly the same service. Canadian notices do the same thing under the Telus Guardian name.

This is why so many real notices go in the trash can. The return address is a stranger’s.

Confirm the vendor on the breached company’s own site

The letter itself proves nothing. Anyone can print a letter. But a breached company almost always posts its own notice, and that notice names the vendor it hired.

So do one check: type the breached company’s web address yourself, find its breach notice, and see whether the vendor name and the deadline match your letter. Do not use the phone number or the link in the letter to confirm the letter. That reasoning runs in a circle.

Take the iRhythm breach as the live example. iRhythm told the SEC that a threat actor stole patient data in June 2026, and the company classified the incident as material. Patients started getting letters on October 2. Its notice lists names, addresses, email addresses, phone numbers, dates of birth, account numbers, device serial numbers, health insurance numbers and dates of service. The company says it does not hold card or bank details.

That list matters, because what was taken decides what you should do. If you cannot find any notice at all, our guide to checking a breach notice before you answer it covers the rest of the verification.

One more thing, because the search traffic on this is enormous. Sometimes the breached company is a business you have never used. A dental insurer. A billing processor. A benefits administrator. You did not sign up with them, but your employer or your doctor did, and your record sat in their system.

Credit monitoring tells you afterward

Credit monitoring watches your credit file. It alerts you when something changes, such as a new account, a hard inquiry or an address update. Those alerts are genuinely useful.

But read the verb. Monitoring tells you that something happened, and it does not stop the thing from happening. You learn about the new account after someone opened it. Then you spend your evenings undoing it.

The offer also has a shelf life. Most run for one or two years, and then they lapse. Your Social Security number does not lapse with them. Neither does the person who bought your record.

A credit freeze stops it first, and it is free forever

The letter does not push this step, because the breached company paid for the other one.

A credit freeze locks your credit report. Lenders cannot pull it, so nobody can open new credit in your name until you lift the freeze, including you. The Federal Trade Commission is blunt about the price: there is no cost to place or lift a credit freeze, and it lasts until you lift it. No expiration date to miss.

You do it three times, at Equifax, Experian and TransUnion. Each bureau holds its own file. Federal law sets the clock: a bureau has one business day to place a freeze you request online or by phone, and one hour to lift one. So the car-loan objection is smaller than it sounds. Thaw it in the morning, refreeze it that afternoon.

A fraud alert is the lighter version. It does not block anyone from pulling your file. It just tells lenders to verify your identity first. It is free, it lasts a year, and you contact only one bureau, which must tell the other two.

Take the free monitoring and freeze your credit as well. They are not alternatives. One watches, one blocks, and only one of them still works in 2030.

Read the activation terms before you type the code

Here is the real reason to slow down, and it has nothing to do with fake letters.

Activating a monitoring offer means accepting that service’s terms. Twice now, those terms have included language that gives up your right to sue. After the 2017 Equifax breach, the terms for its TrustedID Premier service carried an arbitration clause and a class-action waiver. Equifax later said the clause did not cover the breach. The New York Attorney General had called the language “unacceptable and unenforceable.”

Then in 2024, NPR found a TransUnion monitoring activation carrying an arbitration agreement and class-action waiver. A spokesperson said it was posted in error, and the company removed it.

Both companies backed down, which is exactly why you should read the terms: the language got in there in the first place. So if a class action is running over your breach, search the activation terms for “arbitration” and “class action” first. Then decide on purpose, rather than by clicking.

The enrollment code, and what a real one never asks

Your letter carries an activation code. The vendor uses it to match you to the breach, because it cannot simply take your word for it. You type that code into the vendor’s site, from an address you entered yourself.

A real offer never emails you or calls you asking you to confirm your Social Security number on the spot. The FTC says the credit bureaus will not email you asking for your Social Security number or account information. If something claiming to be them does, it is probably a scam. The enrollment form may well ask for identifying details on the vendor’s own secure site, after you navigated there. The difference is who started the conversation.

While you are at it, use the free tool nobody advertises. All three bureaus now let you pull your own report weekly at AnnualCreditReport.com, for nothing, permanently. That is the only authorized site, and the FTC warns that lookalike domains exist to catch your typos.

Mark the day the free term ends

Write the expiration date on your calendar the day you enroll. The offer will not remind you, and your exposure does not expire with it.

On that day, do two things: check that your freezes still stand at all three bureaus, and pull all three reports at AnnualCreditReport.com. Then decide whether to pay for monitoring. For most people the freeze plus a weekly report check carries the load, and the paid tier buys convenience rather than protection.

Your email address was in there too

One detail in these letters gets skipped. Your email address was taken as well, and unlike a Social Security number, it is useful to a thief immediately and cheaply. It goes onto a list. The list gets sold. The mail starts, including mail built to look like the notice you just opened.

That is the problem OptMsg was built for. OptMsg is a private, opt-in email service. You decide who reaches your Inbox, and everyone else goes to Trash, where messages are auto-deleted after 30 days. Our patent-pending opt-in technology makes a leaked address worth less, because reaching your Inbox takes your permission rather than just your address.

There is also no password on an OptMsg account. Passkeys are the primary way in. So when another company gets breached, the login they leak isn’t the login to your inbox.

If these letters have worn you down, create an OptMsg account and start with one address you control.

Create Your Account

Your Inbox. Your Rules.

Frequently asked questions

Who is CyberScout, and is it a legitimate company? CyberScout is a real breach-response and identity-protection vendor, now part of TransUnion through its 2021 purchase of Sontiq. A letter from CyberScout is not proof that a given breach notice is genuine. Confirm the vendor name on the breached company’s own website before you act on the letter.

Should I accept the free credit monitoring in a data breach letter? Usually yes, because it costs nothing and the alerts help. Read the activation terms first for an arbitration clause or class-action waiver. Do not treat monitoring as a substitute for a credit freeze, which blocks new credit instead of reporting it afterward.

Is a credit freeze better than credit monitoring? They do different jobs. A freeze stops anyone opening new credit in your name, and it is free and permanent at all three bureaus. Monitoring reports changes after they happen and usually expires within two years. The FTC treats the freeze as the stronger step.

Why did I get a breach letter from a company I have never used? A vendor, insurer, billing processor or benefits administrator probably held your record on behalf of a company you do business with. Sometimes your employer or your doctor is the customer, not you.

What if I threw the letter away, or the free term already ran out? You have lost nothing that free steps cannot replace. Freeze your credit at all three bureaus, pull your weekly reports at AnnualCreditReport.com, and report real identity theft at IdentityTheft.gov, which builds you a recovery plan.

Sources

Federal Trade Commission, What To Know About Credit Freezes and Fraud Alerts — https://consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
USA.gov, How to place or lift a security freeze on your credit report — https://www.usa.gov/credit-freeze
Federal Trade Commission, Free Credit Reports — https://consumer.ftc.gov/articles/free-credit-reports
Federal Trade Commission, What To Know About Identity Theft — https://consumer.ftc.gov/articles/what-know-about-identity-theft
Snopes, Did Equifax Make Consumers Give Up Their Right To Sue? — https://www.snopes.com/equifax-credit-monitoring-class-action/
NPR, What is in that letter about credit monitoring you get after a data breach — https://www.npr.org/transcripts/nx-s1-5160047
BankInfoSecurity, Heart Monitoring Firm Tells SEC Hackers Stole Sensitive Data — https://www.bankinfosecurity.net/heart-monitoring-firm-tells-sec-hackers-stole-sensitive-data-a-32004
PrivSource, TransUnion Acquires Sontiq — https://www.privsource.com/acquisitions/deal/q5Sjz5
IdentityTheft.gov — https://www.identitytheft.gov/