Cyberscout Data Breach Letter: What It Means and How to Verify It

What Is Cyberscout?

Cyberscout is a data-breach response and identity-protection brand — in TransUnion's own materials and in breach letters it's described as “Cyberscout, a TransUnion company,” not as a stand-alone corporation with public filings we were able to verify. TransUnion announced its agreement to acquire Sontiq for $638 million on October 26, 2021; that announcement lists Sontiq's brands as “IdentityForce, Cyberscout and EZShield.” In practice, when an organization discovers a data breach, it can hire Cyberscout to draft the notification letters, run the mailing and enrollment portal, staff a call center, and deliver the credit-monitoring and identity-theft-protection services offered to the people affected — that is the entire relationship. We could not verify Cyberscout's current legal entity name, its state of incorporation, or a present-day standalone office address; the brand now sits inside TransUnion, headquartered in Chicago, Illinois.

Why Did I Get a Letter From Cyberscout?

How to Tell a Real Cyberscout Notice From a Scam

Five checks, based on what we found in the letters filed with regulators: (1) It names a specific organization you can independently confirm had a breach — search the organization's name plus “data breach,” or check a state attorney general's breach-notification list; a letter naming no organization at all is a red flag. (2) Enrolling is free — the portal is bfs.cyberscout.com/activate, and it only ever asks you to verify your own identity, never to pay anything or hand over a bank login. (3) It gives you a unique enrollment code tied to a real deadline (commonly 90 days from the letter's date, or a fixed date printed in the letter) — a code that “expires in 24 hours” or arrives only by text is not how these letters work. (4) The letter is signed by the breached organization, not by “Cyberscout” as if Cyberscout itself were suing or paying you. (5) When in doubt, don't click a link in an email or text — type bfs.cyberscout.com/activate into your browser yourself, or call the phone number printed on the paper letter, not one texted to you. We could not find any official FTC or state attorney-general warning that names Cyberscout impersonation specifically, but the general rule from the U.S. Postal Inspection Service applies here as it does to any mailed notice: any offer that asks for payment first, or for information a legitimate notice would not need, is probably a scam.

What Enrolling Actually Gets You

What Happens After a Cyberscout Letter Arrives

1. 1

   1. The Notification Letter Arrives

   The letter arrives on the breached organization's own letterhead, not Cyberscout's — for example, a sample notice for <strong>Select Education Group, Inc.</strong> (covering the Institute of Technology, National Holistic Institute, Bauman College, Fremont University, and Arch USA) is dated <strong>March 20, 2024</strong>, and a sample for the <strong>Oakland Museum of California</strong> is dated <strong>November 12, 2025</strong>. Both were filed with the California Attorney General as required breach-notification samples. The envelope carries the “c/o Cyberscout” return address; the letter inside explains what happened and what data was involved.

2. 2

   2. You Enroll With Your Unique Code

   Using the code printed only in your copy of the letter, you go to bfs.cyberscout.com/activate and verify your identity. The Select Education Group letter gave recipients 90 days from the date of the letter to do this; the Oakland Museum of California letter instead printed a fixed cutoff — “the deadline to enroll is February 12, 2026” — a window that, for that specific mailing, has since closed. Whichever format your own letter uses, the code stops working after its stated deadline.

3. 3

   3. Monitoring and Insurance Coverage Begin

   Once enrolled, you get 12 or 24 months (the letter states which) of credit monitoring and identity-theft protection, plus the <strong>$1,000,000 identity-theft insurance policy</strong>, run by Cyberscout through Identity Force, a TransUnion company. This runs quietly in the background — there's nothing further to file or claim.

4. 4

   4. You're Alerted If Something Looks Wrong

   If monitoring flags suspicious activity tied to your identity, Cyberscout's fraud-assistance and remediation service is the point of contact for help — the same team the letters describe as handling “fraud assistance and remediation services.” Credit freezes and fraud alerts, covered in the letter's accompanying reference guide, are additional steps you can take yourself regardless of whether you enroll.

5. 5

   5. A Lawsuit or Settlement, If One Happens, Comes Separately — Later

   A Cyberscout breach letter is not a class-action notice and creates no court case by itself. If the breach later leads to litigation that settles, Federal Rule of Civil Procedure 23(c)(2)(B) requires that a <strong>separate</strong> settlement notice — sent by a court-appointed administrator, not Cyberscout — name the case, the class definition, and your rights, and that notice would typically arrive <strong>years</strong> after this one. See our <a href="/data-breach-settlement-calculator">data breach settlement calculator</a> if you're trying to figure out whether a specific breach has reached that stage.

Scam Alert: Fake Breach and Monitoring Letters

We could not find any official FTC or state attorney-general warning naming Cyberscout impersonation specifically as of September 2, 2026. That doesn't mean fraudsters ignore it — breach notifications and “free monitoring” offers are widely imitated in general — so the same structural checks that apply to any mailed notice apply here:

Cyberscout Data Breach Letter FAQ

Related Consumer Brand Lawsuits