A Breach Letter Lands in February and Two of the Names on It Are Children

Technology, October 30, 2026: The envelope reached a household outside Columbus in the second week of February, which is the worst possible week for this particular piece of mail to arrive. W-2s were already on the kitchen counter, the family's preparer had an appointment booked for the first Saturday in March, and the letter explained that a billing vendor used by their children's dental practice had suffered an intrusion the previous fall. Four names appeared on the notice: two parents, two children, ages nine and thirteen. Names, dates of birth, insurance identifiers and Social Security numbers. The adults' exposure was the ordinary kind. The children's was not.

Why the calendar made this letter more expensive than a summer one

A breach notice in July is an administrative chore that can be spread across a few evenings. The same notice in February sits directly on top of a filing deadline, and that collision is what drove most of what this family spent. A stolen Social Security number is most immediately useful to someone filing a fraudulent return early in the season and collecting a refund before the legitimate taxpayer files. Dependents are attractive for the same reason, since a child's number has usually never been used and nobody is watching it. The parents had roughly eight weeks before the April deadline, and every step they took had to fit inside that window.

Their first decision was to move the preparer appointment forward rather than back. That sounds trivial. It mattered, because filing early is the one protective step that costs nothing and forecloses the most common form of damage, and because it set a hard date that organized everything else. The preparer charged the same fee for a February appointment that she would have charged in March. The family's only cost there was giving up the two or three weeks they usually spend hunting for a last charitable receipt.

What the hotline call actually settled

The notice carried a toll-free number and an enrollment code for two years of credit monitoring, paid by the vendor. The father called on a Tuesday morning, from work, which turned out to be the first real expenditure: not a fee, but a little over an hour of a paid workday, most of it on hold. The representative confirmed what the letter had implied without stating plainly, that the enrollment code covered the two adults by default and that the children had to be added through a separate pediatric product with its own form. She also confirmed the exposure category, Social Security numbers included, which is the single fact that determines whether a household should freeze credit or simply watch it.

That distinction is worth isolating. Monitoring tells you after something has happened. A freeze stops the most common thing from happening at all, and at the three nationwide bureaus it is free to place, free to lift and free to remove, for adults and for minors alike. The family enrolled in the monitoring because it was already paid for, then treated it as a backstop rather than a plan. The Federal Trade Commission is the federal agency responsible for identity theft recovery guidance and runs the official reporting process, and its materials are the reference the parents worked from rather than the vendor's.

The minor freeze is a paper process, and the paper is where the money goes

Freezing an adult's credit takes a few minutes online at each bureau. Freezing a child's takes an envelope. Because a minor generally has no credit file, each bureau has to create one and then lock it, and each requires proof that the requesting adult is who they claim to be and has authority over the child. In practice that meant, for each of two children at each of three bureaus, a copy of the child's birth certificate, a copy of the child's Social Security card, a copy of the parent's driver's license, and a copy of a utility bill showing the address. Six packets. The mother assembled them on a Sunday afternoon.

The household did not have a clean certified copy of the younger child's birth certificate, so one had to be ordered from the county, which carries a modest per-copy fee and, in February, a turnaround measured in a couple of weeks rather than days. Two of the three bureaus accepted plain copies; the family had the parent signatures notarized anyway, at a bank branch where it was free for account holders, because a rejected packet would have cost another two weeks. Each packet went out certified with return receipt, which is the only reason they could later prove the dates. Add photocopying, postage, the certified mail surcharges and the vital records fee, and the hard out-of-pocket total stayed well under what a single month of a paid monitoring subscription would have run.

The hours were the real bill. Two phone calls, one Sunday afternoon of assembly, a trip to the post office, a trip to the bank, and roughly three follow-up calls over five weeks to confirm that each freeze had actually been placed. The father took a half day; the mother used two lunch breaks. Priced at what either of them earns, the labor dwarfed the postage by a wide margin, and that ratio is the one consistent finding in breach response. The cash cost is small. The calendar cost is not.

The one step that cost nothing and did the most

Before the freezes were confirmed, the parents applied for Identity Protection PINs from the IRS for all four members of the household, including both children. The PIN is a six-digit number that must appear on the return for it to be accepted electronically, which means a fraudulent filing using any of those Social Security numbers fails at submission rather than succeeding and then needing to be unwound. The application is free and runs online with identity verification. It also issues a fresh number every year, which becomes a January errand from then on, and that is a far cheaper annual habit than the alternative.

They filed on the first Saturday in March, as planned, and the return was accepted the same evening. By the end of April, all six minor freezes were confirmed in writing, the certified mail receipts were filed with the tax paperwork, and the monitoring enrollment was running quietly in the background where it belongs. The total of every invoice, fee and stamp came to less than the family's grocery bill for a week.

What the letter bought them, in the end, was a set of protections they would have been entitled to place at any point and had simply never placed. The children's files are locked until the parents choose to lift them, which for the thirteen-year-old will likely be a student loan application five years out, a single phone call away.