Was It Breached Secria

How to tell if a data breach letter is real

A company that notifies more than 500 Californians must file a sample of its letter with the state attorney general, which posts it. Compare yours line by line.1

Mailing center name
Return address

Date

Notice of Data Breach

Dear Your name,

Company provides services to your health plan or provider. ...

... to enroll, visit Enrollment site and enter your code by Deadline.

If you have questions, please call Phone number ...

  1. The return addressLetters often come from a mailing center, not the company. Real samples come from "Return to Kroll", "Return Mail Processing" and a "Secure Processing Center".2,5,6
  2. Why they have your dataVendors say who they work for, because most people have never heard of them.2,4
  3. The enrollment siteIt should match the filed sample exactly. Type it in yourself and use the code from your letter.2,4,5,6
  4. The phone numberCheck it against the sample or the company's own notice page before you call.3,7

An example letter, built from the parts real breach letters share. Checked 29 October 2026 against the sources.

Four real letters, side by side

Each row comes from the sample the company filed with California. If yours names one of these companies, check it against its row.

CompanyReturn address on the sampleMonitoring and enrollment siteQuestions line
TriZetto Provider SolutionsData Breach Notification Center, Return to Kroll2Kroll, enroll.krollmonitoring.com2(844) 572-2725From TPS's notice page; the sample leaves it blank.3
Unlimited Technology SystemsReturn to Kroll4Kroll, Enroll.krollmonitoring.com/redeem4(844) 576-30634
CareCloudReturn Mail Processing, 7 Clyde Road, Somerset, NJ 088735IDX, app.idx.us/account-creation/protect5(866) 329-9984IDX's enrollment line.5
MedtronicSecure Processing Center, P.O. Box 3826, Suwanee, GA 300246Epiq, www.privacysolutionsid.com6888-289-68066

Find the filed sample in three steps

California posts samples of notices sent to more than 500 of its residents.1

  1. Step 1

    Open the attorney general's list of data security breaches.1

  2. Step 2

    Search for the name of the organization that sent your letter.1

  3. Step 3

    Click its name, then the link titled "Sample Notification".1

If your letter doesn't match

A missing sample doesn't make a letter fake: only notices to more than 500 Californians are filed there.1

  1. Check another government list.Texas posts breach reports by company name, and HHS lists health breaches.8,9
  2. Call the company on a number you look up yourself.For unexpected messages, IdentityTheft.gov says not to use the contact details they give or the number on caller ID.7
  3. Don't answer unexpected calls, texts or emails about it.Scammers often pretend to be from a business you know, IdentityTheft.gov says.7
  4. Report a fake.Tell the FTC at ReportFraud.ftc.gov.7

Questions people ask

Is a Kroll letter in the mail legit?

Kroll is a firm companies hire to run identity monitoring after a breach. TriZetto Provider Solutions and Unlimited Technology Systems both use it, and their filed samples show a "Return to Kroll" address.2,4 Check the enrollment site and phone number in yours against the sample for the company named in it.1

Why did I get a breach letter from a company I've never heard of?

Often because a company you do deal with used it as a vendor. TriZetto's letter says it provides billing services to "your healthcare provider"; Unlimited's says it provides practice management software to providers.2,4 California notes that the organization sending a notice isn't always the one that had the breach.1

Should I sign up for the free monitoring in the letter?

IdentityTheft.gov says to accept free credit monitoring if a company offers it.7 Enroll through the site printed in the filed sample, and see what to do after a data breach for the other steps.

Sources 9
  1. Search data security breaches, California Department of Justice, Office of the Attorney General. Read 29 October 2026.
  2. TriZetto Provider Solutions: filing and sample notice (reported 11 February 2026), California Attorney General. Read 29 October 2026.
  3. Notice of Data Breach, TriZetto Provider Solutions, hosted by Kroll. Read 29 October 2026.
  4. Unlimited Technology Systems, LLC: filing and sample notice (reported 21 July 2026), California Attorney General. Read 29 October 2026.
  5. CareCloud, Inc.: filing and sample notice (reported 25 July 2026), California Attorney General. Read 29 October 2026.
  6. Medtronic Inc.: filing and sample notice (reported 29 June 2026), California Attorney General. Read 29 October 2026.
  7. What To Do if Your Information Was Lost or Stolen, or Part of a Data Breach, IdentityTheft.gov, Federal Trade Commission. Read 29 October 2026.
  8. Data Security Breach Reports, Office of the Texas Attorney General. Read 29 October 2026.
  9. Breach Portal: HIPAA cases currently under investigation, U.S. Department of Health and Human Services, Office for Civil Rights. Read 29 October 2026.

Every page is checked against the company's own notice and a government record, and every source shows the day we read it. How we check