A Breach Letter Arrives in January. The Three People Who Can Actually Answer It

Technology, September 19, 2026: The letter reached the Renwicks in the last week of January, in the same run of mail as a W-2, a mortgage interest statement, and a brokerage form marked corrected. It was a single sheet, folded in three, from a dermatology practice the household had used twice in six years. It said that an unauthorized party had accessed certain files, that the practice took the security of information seriously, and that an enrollment code at the bottom of the page was good for twenty-four months of credit monitoring. It did not say what had been taken. That was the question they spent the next eleven months answering.

The name on the envelope was not the company that lost the file

The practice had not been breached. Four paragraphs in, past the apology, the notice referred to an incident at a third party that handled billing and statements on the practice's behalf, and it was that vendor's systems that were accessed. This is the ordinary shape of it now. A household transacts with a clinic, a school district, a pension administrator, or a county tax office, and the data sits with a subcontractor two steps back, invisible at the counter and unnamed on the invoice. The Renwicks had never heard of the vendor. They had also never had a chance to decline it.

That distinction mattered more than it looked. The practice sent the letter because state law makes the party that owns the relationship responsible for telling you, but the practice was not the party that knew what was in the exposed file. Two organizations, one letter, and the knowledge split between them. When Mark Renwick called the number printed under the enrollment code, he reached neither.

The person on the phone works for a third company, and the script has edges

The number routed to a call center run by the breach response firm the vendor had retained: the same firm that printed the notices, stuffed the envelopes, and stood up the enrollment site. The representative was patient, competent, and working from a document that told her exactly what she was permitted to confirm. She could enroll him. She could reissue a code. She could not tell him whether the file that mentioned his household contained a Social Security number, a date of birth, a diagnosis code, or a routing number, because her contract gave her a script and the script stopped there.

That is the party most people overlook, and it is worth understanding before you get angry at the wrong person. The voice on the line is not the breached company, not its lawyer, and not its security team. It is a vendor hired for a fixed term to handle volume, and the limits of the call are a contract term, not an evasion. Mark asked her one useful question instead: who at the practice was listed as the contact for privacy questions. She read him the name and the direct extension from the same notice he was holding.

The privacy officer at the practice called back two days later and answered in ninety seconds what the call center could not. The exposed statement files included name, address, account number, and Social Security number. No clinical notes. That single sentence changed the response from generic to specific, because a Social Security number is a tax problem before it is a credit problem, and it was the last week of January.

Filing season runs faster than the enrollment clock

The monitoring code was good for two years. The window that actually mattered was measured in weeks. The IRS administers the Identity Protection PIN program, a six-digit number that has to accompany a return filed under that Social Security number, and the practical protection it offers is against someone else filing first. The Renwicks enrolled both adults and their college-age son, wrote the numbers on the front of the tax folder, and filed in the middle of February rather than waiting for April. That sequence, PIN first and return early, is the part of a January breach letter that has a hard deadline attached.

The credit freezes came next and took an afternoon: one at each of the three nationwide bureaus, placed online, free to set and free to lift, with the PINs and the lift instructions printed and filed with the tax paperwork. Monitoring tells you after something happens. A freeze stops most of it from happening. The Renwicks kept both, used the free monitoring for what it is good at, which is noticing a new account they did not open, and did not treat the enrollment code as the end of the matter.

Eleven months later, a fourth party sends a different envelope

In December a postcard arrived from a claims administrator, a company none of them had dealt with either, appointed by a court to run the settlement of the class action filed against the vendor. Here the overlooked party becomes useful rather than frustrating, because the administrator's job is to process documented losses, and documentation is the whole of it. The Renwicks had a folder: the original notice, a call log with dates and the privacy officer's name, the IP PIN confirmations, the freeze confirmations, and two certified mail receipts from a dispute they had opened in March over a credit inquiry they did not recognize.

The final tally was unglamorous. Postage, a handful of copies, and roughly six hours of an adult's evening spread across a year. The claim for documented time and out-of-pocket costs went in three weeks before the deadline printed on the postcard, with the receipts attached, and it was accepted without a follow-up letter. The households that struggle at this stage are the ones reconstructing a January phone call from memory in December, which is an argument for the folder more than for anything else.

The notice that arrives next January will name a different company and a vendor you have also never heard of. The work is the same, and it starts with finding the one person whose job is to answer the question the letter left out.