Why did I get a breach letter from a company I've never heard of?

Why a stranger is writing to you

A breach letter from a firm you never hired is confusing, and the confusion is reasonable. The sender often sits behind the organization you actually dealt with, so the letter has to say how it came to hold your data. This guide reads four notices filed with the California Attorney General. They come from an accounting firm, a court-reporting company, a testing service and a software vendor. It uses only what each letter says about three things: why the sender holds the data, where the data came from, and what the recipient is told to do next. All four are form letters. Where a filed copy still shows a blank or a sample name, this guide says so.

Mercadien: an accountant that received data through a client engagement

The Mercadien letter gives its reason in the opening paragraph. The letter states, "Mercadien provides accounting and advisory services to financial institutions and obtained your information while providing these services." That sentence is the whole explanation of the relationship. The firm serves institutions, and your data arrived as part of that work.

The letter ties the data to a specific source, but the filed copy leaves the name blank. The letter says that on August 13, 2026, Mercadien determined that the files involved included information it received from "[Extra1]" related to an advisory services engagement. The bracketed term is a mail-merge placeholder, so a real recipient's letter would carry the name where the filed copy shows the bracket.

The letter also separates the two organizations. It says the incident was on the accounting firm's systems and did not reach the institution that supplied the data.

On timing, the letter says Mercadien detected the incident on November 7, 2025, and then took steps to contain it. The determination about which files held personal information came later, on August 13, 2026, as quoted above.

The letter's next step is enrollment in the free Experian credit monitoring it offers. It sets a clock: . The length of the monitoring appears only as the redacted placeholder ## in the filed copy.

Lexitas: court-reporting files exposed by a server error

The Lexitas letter explains its own business before it explains the incident. It describes the company as a firm that . A person who gave testimony, or whose details appear in a transcript or exhibit, would not necessarily know the company by name.

The letter says the company learned of the problem from one of its own customers. The date given for that notice is May 29, 2026. In the text filed, the customer is not named. The letter does not say which case or party the exposed data belonged to.

The letter says the exposure began years before it was found. The investigation, the letter says, .

It also explains why the data belongs to people with no direct tie to the company. The letter says personal information in the files is . The letter says identifying affected individuals therefore took extensive manual review lasting several months. In this letter, the answer to "why me?" is that your details appear somewhere in legal documents the company handled.

The letter's next step runs through a second company. The return address is "c/o Cyberscout," and the letter explains that A recipient who sees a third unfamiliar name will find that sentence in the "What We Are Doing" section. Recipients are told to use a unique code to enroll in credit monitoring on the Cyberscout site within 90 days of the letter's date.

ETS: a testing vendor writing at a state agency's direction

The testing-service notice begins by naming who ordered it. The notice says that . The sender is the vendor, and the state agency stands behind the letter.

The notice then states why ETS holds student records. It says The data came from the state's testing programs, so the source is the school system itself, with ETS as its contractor.

The notice describes how the data was taken. It says The notice says ETS identified the activity on September 25, 2026. The notice states that the data did not include Social Security numbers, driver's license numbers or financial account information.

The next steps are split by age. The notice says adults may enroll themselves and that a parent or guardian may enroll a minor, with the adult deadline stated as The notice also points readers to a state webpage and gives a warning about scams:

Dorsata: a software vendor, a vendor of its own, and a clinic that asked for the letter

The Dorsata letter has two layers of strangers. Dorsata describes itself as a company that used alongside the provider's health records system. The letter's opening says the incident involved a third-party software vendor, Metabase, whose software Dorsata uses. A patient therefore hears from a company that serves their clinic, about a flaw in a tool that company uses.

The letter gives the timeline in two dates. It says Dorsata was told of the vulnerability on August 12, 2026, and that

The letter says the clinic asked for the notice. After Dorsata told the provider that the patient's protected health information was in the affected data, the letter says: Of the four letters, this one states most directly that the sender is writing at its client's request.

For next steps, the letter's "What You Can Do" section points to the page that follows. The letter says: The letter also says the patient's Social Security number was not involved.

What the four explanations have in common

Each letter answers "why do you have my data?" in one or two sentences, and each answer names a role. Mercadien names a service relationship with a financial institution. Lexitas names litigation support work. ETS names a state contract. Dorsata names a partnership with clinics. None of the four letters is addressed to someone who dealt with the sender directly.

The sources differ in how clearly they are named. The ETS letter names the state agency that directed it. The Dorsata letter points to the patient's own healthcare provider. The Mercadien letter refers to a source, but the filed copy leaves it as a blank. The Lexitas letter names only a customer, with no identification of the case or party.

The next steps follow a pattern. Three of the letters tie enrollment in a free monitoring service to a stated deadline, and one of those runs through a company other than the sender. All four give the recipient an outside place to read about fraud alerts, credit freezes or identity theft. Each letter's sections on state attorneys general and credit bureaus are the same kind of material you would find in any breach notice, and they are separate from the explanation of why the sender holds your data.