Two Breach Letters, Six Weeks Apart, and the Company Neither of You Hired

A household opens a letter from a medical group they have used for years. The letter says an unauthorized party accessed a system, that names, dates of birth and insurance identifiers may have been involved, and that twelve months of credit monitoring is available with an enrollment code. Six weeks later a second letter arrives, heavier, from a company nobody in the house has heard of. Same incident. Different enrollment code, different deadline, and a longer list of data elements, including the one nobody wants listed. Two notices, one event, and the name on the second envelope is the one that matters.

The company neither party hired, exactly

The medical group did not lose the data. Its billing and statement vendor did, and that vendor serves dozens of practices, which is why the same letter landed in other households across the state in the same window. The reader never signed anything with that vendor, never saw its name on a form, and could not have chosen a different one. The practice picked it, years back, on price and integration. That is the party most people read past: the processor sitting one layer behind the brand, holding the file, running the systems, and now writing the notice that governs what the household is offered.

Knowing the vendor's name changes the practical work in three ways. It tells you how many other notices to expect, because one vendor incident often produces staggered mailings as each client practice completes its own review. It tells you where to look for updates, since the vendor usually posts a notice page that gets revised while the practice's front desk knows nothing. And it tells you whose deadline is real. The enrollment window on the second letter, from the vendor, is the one attached to the actual service contract.

Who decides what the letter says

The content of a breach notice is negotiated well before it reaches a mailbox, and the household is not at the table. Outside counsel for the vendor drafts it. The vendor's insurer, through a cyber policy, often funds the mailing and the monitoring, which means the insurer has a view on how many people get notified and for how long the monitoring runs. The practice reviews the draft, sometimes objects to how its name appears, and signs off. The Federal Trade Commission oversees data security and identity theft recovery for consumers, and its guidance sits in the background of those drafting conversations, but the specific terms come from the vendor's side of the table.

This is why the two letters differ. The first, from the practice, was written from a preliminary summary and hedged accordingly. The second, from the vendor, came after the forensic review closed and reflected what the investigators actually confirmed. Households treat the first letter as the event and the second as a duplicate. The order is backwards. The later notice, with the longer data list, is the accurate one, and it is the document to keep if anything downstream turns into a dispute about what was exposed and when the household was told.

The scope grows after the notice, and the hours are yours

Here is how the job expands. The monitoring enrollment takes twenty minutes and asks for the same identifiers that were just exposed, which is uncomfortable and still worth doing. Then the credit freezes, three bureaus, each with its own account setup. Then a call to the insurance carrier if a member identifier was involved, because medical identity misuse surfaces on an explanation of benefits, not a credit report. Then, months later, a class action notice with a claims administrator and a form asking for documented losses and time spent. None of that was in the original letter, and every hour of it belongs to the household.

The claims administrator is the second overlooked party, and it operates on the same logic as the vendor. It is a contractor, paid out of the settlement, working to a schedule set by the court and a claims rate the defendant modeled in advance. Its deadlines are firm because its contract says so. Its form usually pays a small flat amount for attested time and a larger documented amount for actual losses, which is why the receipts, call logs and dates you kept during the first month become the difference between a token payment and a real one.

Keeping the file so the later ask is easy

One folder does the work. Both letters, the enrollment confirmations, the freeze confirmation codes, and a plain running note of dates and minutes spent on calls. Add the vendor's name to the note in capital letters, because in eighteen months, when a claims notice arrives referencing an incident by the vendor's name and a date you have forgotten, that single line is what tells you the notice is yours and not junk mail.

The household in this case enrolled twice, froze all three bureaus, and filed a documented claim two years later in under an hour. The letters were never the event. The vendor was.