Credit monitoring and identity protection offers in breach notice letters

What this guide covers

This guide reads two notices filed with the California Attorney General. The first is the City of McMinnville filing dated 2026-09-29. The second is the Frazer LLP filing dated 2026-10-16. The question is what credit monitoring or identity protection each letter offers, for how long, and whether the offer changes with the type of organization or the data exposed. Two letters cannot establish a pattern across all organizations, so the comparison below describes these letters only and does not rank them. Every statement is attributed to the letter that makes it.

What the City of McMinnville offers

McMinnville's letter says the city is providing access to single-bureau credit monitoring, a single-bureau credit report and a single-bureau credit score at no charge.

The letter describes what the monitoring does. It says the services provide alerts for twelve months from the date of enrollment when changes occur to the reader's credit file.

The letter names a second service, fraud assistance. It says the city is providing proactive fraud assistance for any questions the reader might have or if the reader becomes a victim of fraud. It says Cyberscout, a TransUnion company, provides these services.

Paying for the services does not enroll anyone automatically. The letter says the city is covering the cost but the reader must complete the activation process. The letter also sets a time limit: it says the reader must enroll within 90 days from the date of the letter.

Two conditions limit who can use the offer. The letter says enrollment requires an internet connection and an e-mail account, and may not be available to minors under 18.

The term ends on a fixed schedule. The letter says that at the end of twelve months the services will be deactivated.

Separately from the paid offer, the letter's list of steps tells readers they can freeze their credit at no cost. It says that under federal law consumers cannot be charged to place or lift a credit freeze.

What Frazer LLP offers

Frazer's letter is a sample copy with several blanks, and the length of its offer is one of them. The section heading reads "Enrolling in Complimentary - Month Credit Monitoring," so the number of months does not appear in the filed copy. This guide therefore cannot state how long Frazer's monitoring lasts.

The letter ties the monitoring to a broader product. It tells the reader to activate the credit monitoring provided as part of an IDX identity protection membership. It adds that the monitoring must be activated to be effective.

Frazer's letter also sets an eligibility condition. It says the reader must have established credit and access to a computer and the internet to use the service.

The enrollment window is a calendar date rather than a count of days from the letter. The letter says the deadline to enroll is January 16, 2027.

The letter gives guidance on how monitoring interacts with other protections. On fraud alerts, it recommends placing an initial one-year fraud alert on the reader's credit files at no charge. On security freezes, it says a reader who froze their credit before enrolling must remove the freeze to sign up for monitoring. The letter says the reader may refreeze the credit file after signing up.

How the offers differ

The two letters differ on several points that are visible in the text:

• Provider. McMinnville's letter names Cyberscout. Frazer's letter names IDX.
• Package. McMinnville's letter describes single-bureau monitoring, a report and a score, plus fraud assistance. Frazer's letter describes an identity protection membership with a credit monitoring component.
• Term. McMinnville states twelve months. Frazer's filed copy leaves the month count blank.
• Enrollment window. McMinnville counts 90 days from the date of the letter. Frazer gives a fixed date in January 2027.
• Stated conditions. McMinnville's letter mentions internet, e-mail and age. Frazer's letter mentions established credit and internet access.

These are differences between two specific letters. McMinnville is a city and Frazer is a law firm, but nothing in either document says the differences come from organization type. A reader should not treat the contrasts above as a rule for cities or law firms. The documents point to vendor, template and notice timing as the visible variables, and they do not say which of these, if any, drove the differences.

What the letters say about the data exposed

The question asks whether offers change with the data exposed. These two documents give limited help.

In McMinnville's letter, the section on information involved says the impacted information varied by individual. The list that follows is blank in the filed copy. The reader of this guide therefore cannot link any specific data type to McMinnville's monitoring offer. The offer described above is credit-based in any case.

Frazer's letter shows one place where the content changes with the data. It includes a section headed "Protecting Your Medical Information." In that section the letter says it has no evidence that the medical information involved was or will be used for any unintended purposes. The section offers no product. It lists practices a reader can follow, such as reviewing the explanation of benefits statement received from a health insurance company.

In these two letters, then, the paid offer is credit monitoring in both cases. The only data-specific content is a set of reader actions in Frazer's letter, tied to medical information. Neither letter, as filed, lists the data types in a way that lets a reader tie them to the length of the offer.

What this comparison cannot show

Several limits apply to this guide. Only two letters were read, so the guide cannot say what is typical for municipalities, law firms or any other group. Frazer's term is blank in the sample copy, so the duration question has a full answer for only one of the two organizations. McMinnville's data list is blank, so the data question is only partly answerable for that letter. The guide also does not assess how well either offer would work for any reader.

For anyone using these filings to check what an organization promised, the practical points come from the letters themselves. The McMinnville letter states a 90-day enrollment window counted from the letter date and a twelve-month term. The Frazer letter states a January 16, 2027 deadline and leaves its term blank in the filed sample. A reader comparing a copy of an actual letter to the filing should check the term, the deadline and the provider named, because those are the points where these two letters diverge.