ExpressVPN is no longer simply one of the best VPNs – it's a full-blown privacy suite. One subscription gets you up to five privacy-focused apps: ExpressVPN, ExpressMailGuard, ExpressAI, ExpressKeys, and Identity Defender.

We've been getting hands-on with each new app and now it's the turn of Identity Defender.

Identity Defender is a comprehensive suite of identity protection tools designed to help you manage, remove, and better control your online data. I decided to check it out, testing it for over a week on Android, iOS, and Windows, to see if it lived up to the hype.

Currently, the feature is only available for new ExpressVPN Advanced and ExpressVPN Pro subscribers in the US. This is due to the complexity of regulations and laws that must be followed. But testing it out in one country before launching globally (if the company decides to do so) is no bad thing.

The suite has its own iOS and Android apps that operate completely independently of the ExpressVPN app, making it easier to find exactly what you need. You don’t have to use every tool either – you can cherry-pick through options and only set up the monitoring you want. Just make sure you choose the right subscription tier, or you may be disappointed.

So, taking all that into account, let's see how I got on.

Identity defense tailored to individuals

Many of the identity defense tools on the market were created for corporations, not individuals. Whether it's detecting active fraud or potential data breaches, having the same level of protection available on an individual basis is crucial.

Identity Defender is only available with the Advanced and Pro tiers of ExpressVPN, and you can’t purchase it separately. However ExpressVPN is currently cheaper than it has ever been, and one subscription includes up to five privacy-focused apps.

A 28-month ExpressVPN Advanced plan costs $2.92 per month ($81.72 upfront pre-tax). A 28-month ExpressVPN Pro plan costs $4.87 per month ($136.32 upfront pre-tax).

Both plans come with a 30-day money-back guarantee. ExpressVPN Pro unlocks all Identity Defender features, as well as ExpressAI and Dedicated IP.

Ease of Use

After you download and install the Identity Defender mobile app to your smartphone or tablet, you’ll log in and enter a nominal amount of information, including your name, DOB, email, state, and city. Once you accept the terms and conditions, you can begin setting up the individual tools.

To put your mind at ease before we continue, Identity Defender also falls under ExpressVPN's strict no-logs and privacy policies. The company performs regular independent privacy and security audits, with 20+ completed to date.

ExpressVPN baby-steps you through the entire process for each tool – very user-friendly, even if you’re a beginner. If you do have any issues, ExpressVPN offers a detailed setup guide for Identity Defender in its website's Support Center. You can also find useful information by tapping the Profile icon in the app, scrolling down, and pressing Getting Started.

You can enter up to 10 email addresses, physical addresses, and phone numbers. The app also has monitoring options for passports, driver's licenses, bank information, medical IDs, and credit cards.

If you need to edit or add information after your initial setup phase, just click the Security icon in the app, scroll down, and tap the Review or Update Monitored Information button.

The same section has a dropdown menu at the top that shows your Dashboard by default, but you can pick from Services, Alerts, Dark Web, Address, SSN, and Neighborhood.

Testing tools in real-time

The best thing about Identity Defender is the real-time monitoring and alerts. Home, finance, auto, and Dark Web monitoring are all available in real-time.

I downloaded the app for iOS and Android, and tested it via the ExpressVPN app for Windows. I tested each of the tools available for the Advanced tier over 7 days, twice a day (morning and evening), each session for a minimum of 10 minutes. It also ran in the background on my devices for at least half of each day. Switching up the testing times allowed me to stay on top of any data alerts.

Let’s look at a few of the tools in detail, starting with Data Removal because it’s one of the biggest draws for me. On initial setup of the suite, I entered one email. To see how easy it was to edit information, I went in and added another. It was quick and painless, and the tool began monitoring it immediately.

I received an email alert that data was found.

I was notified that the data removal tool was in the process of removing my information from three websites, one of which I recognized as a platform for downloading free clipart. It was nice to recognize sites I knew I had been on, proof of the tool doing its job. The tool displays "in progress," and you receive an email notification when data removal is complete.

The data removal tool does its job well, and the detailed description of which information was removed helps put you at ease. Mine included not only the emails, but any other information added on the sites, including my name, phone number, address (and in one instance, legal records and my mother's maiden name).

You can check your credit score right in the app – it uses the well-know agency, Experian. I’ll spare you the details of my credit report (grad student), but the data is accurate when compared to my recent big-three credit report.

What I will say is that the credit score and monitoring tool provides real details, including your payment history, derogatory marks, total number of accounts, and hard inquiries. Just click on the Credit Score icon on the Home page, and you’ll see your credit score at the top.

When you scroll down, you’ll see all the positive and negative credit marks that impact your score, click the > icon on the right side of each, and you can view recommended actions to improve or maintain your credit.

I live in a fairly rural area, so I didn’t receive any address or neighborhood watch alerts. Luckily, I can add or change my location. I entered a well-known street address in the city, performed a search within a one and five-mile radius, and immediately red location markers appeared, indicating known offenders.

If you click a location marker, it shows the offender's name and address, along with a link to view details. Details include age, approximate distance, physical traits, and offense.

I didn’t receive alerts on my SSN, address, or home. Those are the types of identifiable information you don’t want floating around on the internet, so I wasn't heartbroken. That said, it’s nice to know the app is monitoring for potential breaches, and it provides an easy way to stay on top of it.

I was also pleasantly surprised to find that the iOS and Android apps are almost identical. Most of the time, at the very least, iOS and Android apps have different verbiage, but that wasn't an issue with Identity Defender – consistent UI is something ExpressVPN does very well.

Not as convenient on desktop

The only real flaw I found with the Identity Defender suite is the inconvenience of using it on a desktop.

You can find links to the Identity Defenderid suite tools within ExpressVPN’s Windows app by clicking the Add-ons icon on the left-hand menu. A window containing available tools appears to the right of the map.

When you click on one, you’re redirected to your account dashboard to view the information. You can still see everything you would within the app, it just isn’t as convenient as the mobile app. It isn’t a huge flaw, just extra steps.

However, ExpressVPN has said Identity Defender isn't meant to function as a standalone desktop app, it's designed to be mobile-first. The VPN said the desktop version is seen as a "companion view, rather than a primary user experience."

On a nit-picking level, I noticed that the Privacy tab's dropdown menu showed no items in progress for almost a minute before it displayed accurate statistics for each field. It may have been under a minute, but it's still a lag, and it happened every time I used the menu on both Android and iOS.

I'd love to see a standalone app for Windows and macOS, and less delay when loading Privacy (data removal) updates. Ease of use and no glitches across all platforms is never a bad thing.

Being proactive about your data just got easier

Overall, Identity Defender is a win for ExpressVPN. It provides online data monitoring with a click, all in the convenience of a mobile app.

It provides neighborhood alerts to help keep your family safe, data removal services to minimize your digital footprint, credit monitoring for the fiscally-minded, and it's really easy to use.

Just remember, it's a US-exclusive (for now), so anyone outside the States will have to wait.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

Scammers have a new way to try and steal your personal and financial information using QR codes and fake official-looking notices.

According to a new report from Bleeping Computer, scammers are sending out false "Notice of Default" traffic violation text messages. The messages appear to mimic state courts across the U.S. The violations demand you scan a QR code that takes you to a phishing site that requires a $6.99 payment that is used to steal credit card information.

The scam seems to be an update to a toll violation campaign that also used text messages to confuse recipients last year.

Bleeping Computer reports that the new QR code version began in the last few weeks targeting residents in New York, California, Connecticut, Illinois, New Jersey, North Carolina, Texas and Virginia.

The new version contains an image of a fake court notice with an embedded QR code. "This notice constitutes a final and urgent warning regarding an outstanding traffic violation involving your registered vehicle within the State of New York," reads the false notice.

The notice claims there is an unpaid parking or toll violation that needs to be paid immediately or the target will have to go to court. There are instructions to scan the QR code.

From there, you are taken to a site that impersonates your state's DMV or traffic agency. The balance is apparently always $6.99. In the New York example, it uses URLs like ""ny.gov-skd[.]org" or "ny.ofkhv[.]life".

The sites have forms where you are encouraged to enter personal and credit card information. Once scammers have that information it can be used to steal more data via follow-up phishing attacks for financial fraud or even identity theft.

How to stay safe

In general, you should not click a link or scan a QR code from an unknown phone number or email address, especially if it demands payment. As noted by Bleeping Computer, state agencies have been quick to note that they do not send text messages demanding personal information or payment.

A real DMV will not threaten you with prosecution over unpaid tolls, especially not via text message. You also want to check for spelling errors and try Googling the code or violation number to see if it's legit.

If you do click on a link, triple-check the URL. You should see a .gov at the end, not something like .org or .life as seen in this scam.

Finally, if you do send this kind of information out via the links, make sure you contact your bank and set up a fraud alert. You can also protect yourself online by making sure you have one of the best antivirus software solutions installed and up-to-date on all your devices (including mobile), and making sure it has features like a VPN, a browser that will alert you to suspicious websites, spam alerts, and identity monitoring or identity theft protection features.

Whether it's the DMV, a toll organization, or other traffic authority, nobody wants to receive a threatening text message. The induced panic is a lure that remains quite effective.

Now that you know how to spot this type of scam, you're fall less likely to fall victim to one yourself. However, you should also pass this information on to your friends and family to keep them safe too.

More from Tom's Guide

• Dangerous new NoVoice Android malware could be undeletable on older phones — check your settings right now
• I put Apple’s new macOS ClickFix warnings to the test and they actually worked — now I want them on Windows too
• The best internet security suites for total online protection

Aura, an identity protection company, released a statement this week confirming a data breach that exposed nearly 900,000 customer records. Those records contained names and email addresses.

According to the statement, the breach was caused by a voice-based phishing attack that gave an unauthorized third-party access to an employee account for "approximately one hour." That exposed the sensitive data of 20,000 current customers and 15,000 former customers.

The company has terminated access to that account, and says that the malicious party was able to access the nearly 900,000 records via a marketing list from a company Aura acquired in 2021. However, Aura asserted that while the exposed information from the list did contain contact information from current or former Aura customers, no user accounts were accessed.

"No sensitive information provided by customers to Aura for monitoring purposes — such as Social Security numbers, financial information, credit records, or passwords — was compromised," Aura said.

For the unaware, Aura is an identity protection company that sells identity theft protection, credit and fraud monitoring and online tools meant to protect against phishing.

We consider Aura one of the best identity theft protection services available. If this breach makes you nervous, there are other options, like LifeLock worth considering.

Hacker group claims responsibility

The hacker group ShinyHunters claimed responsibility for the attack, according to BleepingComputer. The group said they stole 12GB of files containing personally identifiable information from customers, as well as Aura corporate data.

Allegedly, ShinyHunters failed to ransom the data and subsequently released the information. "The company failed to reach an agreement with us despite all the chances and offers we made. They don't care."

Have I Been Pwned added the Aura breach to its database and noted that the breach included IP addresses and customer service comments. In an X post, HIBP noted that "90% were already in" their database as having been previously exposed in other incidents.

Aura is in the midst of an internal review with external cybersecurity experts and the company has also notified law enforcement.

If you are an Aura customer, you should receive personalized notifications soon.

How to stay safe after a data breach

Aura insists there is no "ongoing risk to customer data" and that is identity theft services are still safe to use. The company says it will support impacted customers, but it's not clear what they will offer.

Usually, companies exposed by data breaches offer complimentary identity monitoring services, though there are other steps you can take.

You can claim up to one free credit report a year, so that might be something to consider. Likewise, you can also place a free fraud alert on your credit file by contacting one of the major credit agencies like Equifax, Experian or TransUnion. These alerts usually last for 90 days.

As always, you'll want to be on high alert for phishing attacks and social engineering attacks, especially ones that urge you to "act now." Avoid clicking on any links, QR codes, or attachments from unknown senders.

Now might also be a good time to consider password haul by making strong, complex passwords for all your accounts. You should consider using one best password managers to do so.

Let us know if you receive a notification letter from Aura.

More from Tom's Guide

• More than 220 million iPhones under attack from new DarkSword exploit — how to stay safe
• What is AgeGO, and is it safe to use?
• Online age verification in the USA – a complete timeline

IDShield is one of the best identity theft protection services and is known for providing solid, basic coverage for those looking for entry level monitoring of banking and investment accounts, credit reports, identity theft assistance and identity insurance, dark web monitoring and other alerts that may indicate that someone has run off with either some of your personal information or worse yet, your whole identity.

However, one of its best hidden features – and the reason it’s our pick for best for privacy – is its Reputation Manager service. Basically, this feature cans multiple social media profiles and will not only highlight any potentially inappropriate posts or photos you may want to remove but it will also help you easily delete them.

Why you want to scrub your social media profiles

IDShield says that, according to its surveys, the service's average customer has over 1,500 posts and photos on Facebook alone – and most people have multiple social media accounts that span decades. Likewise, the average person has over 100 online accounts and apps to go with them, so you may have shared a lot of details about your personal life across them.

Think for a moment about what you may have posted on your profile page five, eight or ten years ago and how different of a person you were then. Think about the people you knew, how you spent your time and what you’re trying to accomplish now, what kind of jobs you want to get hired for, who you want to date, what kind of apartments you’re applying for.

Having all that data exist online isn't just a potential drawback when it comes to something embarrassing, or as a strike against you personally. It can also be a privacy risk. Old data that exists online can tell people too much about you, which can be used for identity theft, fraud, phishing or more.

What IDShield’s Reputation Manager does

IDShield's Reputation Manager will review social media accounts including Facebook, X, LinkedIn, TikTok, Instagram and reddit, and then assist you with identifying what you may want to remove by flagging anything that it sees as potentially damaging to your reputation. It provides a Personal Score and recommendations for what may need a review, but it will also help you to easily delete or archive older posts and photos.

The Reputation Manager looks for particular things to flag in photos and text posts. For photos, the service will highlight weapons, ‘racy’ imagery, adult content and drugs or alcohol. In text posts, it is searching for profanity, inflammatory or toxic content, and negative comments that are directed at an individual or group.

It then tags the posts as either medium or high risk, and will include a reason as to why the post was flagged. You get to decide whether to delete, archive or approve the content. You can select items to delete from a specific date range, search for a photo or post by putting in a place, category or keyword.

The tool can also help you review your online privacy, by giving you a walkthrough of how you can set your visibility and ad preferences in the settings menus. This will limit how social media companies (and third-parties) can use your data which also limits your exposure and risk during data breaches, and limits your online footprint with data brokers. That means less of your addresses, medical data, legal issues, employers, school records and more are for sale or publicly available online.

An ongoing process

The last helpful step that IDShield's Reputation Manager takes is to help you move forward in the right direction by building a positive reputation. The walkthrough guides also provide step by step instructions to improve social media profiles with recommendations on how to write your own posts that share your expertise and professional interests.

The tool will even help you gain visibility and make your profile more polished and professional, so that it is noticed for the right reasons by potential landlords, employers, schools or whomever is searching the internet for your name. It can also help you build your network by suggesting contacts, companies and other leaders who are knowledgeable about your industry and trends.

Finally, it provides you with a Personal Score so you know how well your various efforts have helped your online appearance, and offers regular rescanning so you know if future posts have had any impact.

Identity theft protection is a great investment on its own but this useful feature is a compelling reason why you might want to choose IDShield over the competiton.

More from Tom's Guide

• Clean up your digital life in 2026 with these 7 easy steps
• New California regulations help delete your personal information off the internet – here’s what to know
• We put the best identity theft protection to the test to protect your entire digital life — these are the services I recommend

Having your sensitive data stolen in a cyberattack is bad enough, but imagine waiting six months just to find out about it. Well, that’s exactly what happened with a major data breach at the insurance giant Aflac.

As reported by Cybernews, after suffering a data breach back in June of this year, Aflac is now notifying 22.65 million individuals about the breach after completing its investigation into the matter. The incident occurred on June 12 when the Scattered Spider ransomware group managed to breach the company’s systems.

While Aflac was able to lock down its systems and contain the incident within hours, the hackers behind the attack managed to steal troves of sensitive personal data on millions during that short time frame.

Here’s everything you need to know about this new data breach along with how to see if you’re affected and the steps you need to take right now to stay safe.

SSNs, health records and insurance info exposed

Back in June, Aflac put out a press release with some but not all of the details on this breach. While the insurance giant disclosed that it was hit by a cyberattack, it didn’t reveal who was responsible nor how many people were affected.

Now though, in a new update (PDF), Aflac has confirmed what data was stolen along with the fact that approximately 22,652,430 individuals — including its customers, their beneficiaries, and its employees and agents — are all impacted. Here is all of the data obtained by Scattered Spider in this breach:

• Full names
• Addresses
• Social Security numbers
• Dates of birth
• Driver’s license numbers
• Government ID numbers
• Health and medical insurance info
• Insurance claims data

It’s worth noting that the exposed data varies from person to person. While some impacted individuals may have just had their names and addresses exposed, others — like policyholders — may have had their Social Security numbers, medical insurance info, and more stolen.

The main reason it took Aflac this long to reveal the full extent of this breach is because of how varied this stolen data is. According to the company, it took six months to complete a file-by-file review to determine exactly whose sensitive information was in the hands of hackers.

How to stay safe after a major data breach

If you’re an Aflac customer or beneficiary, you’re going to want to keep a close eye on your mailbox. This is because the company is now sending out data breach notification letters to impacted individuals.

In addition to finding out exactly what data of yours was exposed, this letter is very important as Aflac is providing free access to one of the best identity theft protection services for 24 months. Impacted individuals can sign up for credit monitoring, identity theft protection, and medical fraud protection from CyEx Medical Shield. However, you’ll need your notification letter to redeem this offer, as it contains a unique activation code.

The final deadline to enroll in these services is April 18, 2026. You can activate your coverage by visiting aflacsecurityincident[.]com or by calling Aflac’s dedicated call center at 1-855-361-0305.

Besides taking advantage of this offer, you’re also going to want to be extra vigilant when checking your email, messages, and even your physical mailbox. Cybercriminals often use stolen data from a breach to launch targeted phishing attacks. By crafting messages using your actual personal info, hackers can easily convince you to give up even more data, like credit card numbers or account passwords.

Since these phishing messages can also contain malware, you should ensure your PC is protected with the best antivirus software. At the same time, you should strongly consider freezing your credit, as a cybercriminal can commit identity fraud if they have access to your Social Security number.

Getting wrapped up in a data breach can turn your life upside down. However, if you stay on top of things, exercise caution with unknown senders, and sign up for the free protection Aflac is offering, you can significantly lower your risk of falling victim to further scams or attacks.

More from Tom's Guide

• Your Social Security number is vulnerable to identity thieves — here's how to lock it down
• 5 steps to safer social media in 2026: The settings you should enable right now
• That mystery gift might be a scam: What brushing scams are and what to do about them

While software may not be the first thing that comes to mind when you think of Cyber Monday deals, it really should be – from antivirus coverage to streaming services, there are all sorts of non-tangible items that are worth shopping for today but you better hurry. Aura, one of the best identity theft protection services out there, has heavily discounted its annual plans by up to 75% off, which brings the monthly fee down to $20 per month for its top-of-the-line plan.

That plan, the Family plan, covers 5 adults, unlimited children and unlimited devices. It offers services like data removal from data broker sites, digital account cleanup to help you shut down unused accounts, spam call and message protection, home and auto title monitoring. However, it also includes a VPN, password manager and antivirus protection. This helps protect the whole household's personal information, and devices, whenever they're online and alerts you about anything that looks suspicious.

Like any quality identity theft protection service, Aura watches out for any signs of identity theft by monitoring for your information online. You get notifications if it catches any signs of a problem such as if your personal information being used on the dark web, or if your Social Security number has been used in a payday loan.

When we tested Aura, we particularly liked the concierge service that assigns a dedicated case manager to handling any issues. Other features that impressed us were the malware protection, the child safety options like alerts if a sex offender moves into the neighborhood or the cyberbullying alerts and the Vault which holds critical documents in a safe place.

Aura has four plans, with one geared toward protecting children only. That tier is currently discounted by 52% and is just $10 a month and offers features like parental controls and safe gaming. The other three are identity theft protection services for individuals, couples or families and are they're all discounted from 50% to 75% for Cyber Monday. This means you can get financial transaction alerts, credit locks and from $1 to $5 million in identity theft insurance for $12 to $20 per month.

Services like Aura can watch out for you, and most importantly, ensure that a small problem never becomes a bigger issue.

For more great discounts be sure to check out our Cyber Monday deals live blog right now.

With everything from malware protection to VPN access and a password manager, Aura takes traditional identity protection to new levels. Its three bureau credit scores and monthly credit reports are complemented by a credit lock button for Experian transactions. Although it has consistently ranked at the top of our list of best identity theft protection services it does fall short in one few key areas: It lacks a credit calculator and simulator to improve your credit scores.

While it can keep an eye out for your family and children as well with sex offender and cyberbullying alerts, Aura uses sophisticated machine learning techniques to model a child’s behavior. Its plans are reasonably priced, include up to $5 million of identity insurance and makes it easy to get started protecting or recovering a stolen identity.

I reviewed the service by signing up with my own information to test what it was really like to set up, use, and how useful all the features were in actual day-to-day practice.

Aura review: Costs and what’s covered

To simplify things, Aura has similar coverage for an individual, couple or entire family. Securing the identity of a single person costs $15 a month, but the company discounts that to $12 a month for the first year; annual plans cost $144.

The individual plan includes $1 million of identity theft insurance, all sorts of alerts and notifications as well as three credit bureau monitoring and annual reports. This plan not only monitors your home and vehicle’s title but includes an array of software, bringing Aura to the level of a security suite with home-grown malware protection and access to VPN infrastructure from Hotspot Shield for up to 10 systems per adult user and Aura’s own password manager.

Aura’s Couple plan covers two attached adults, although they don’t need to be married. It mirrors the individual plan for both and ups the insurance to $2 million. The Couple plan costs $29 per month, although Aura discounts it to $22 for the first year. It costs $264 if you prepay a year’s worth of coverage.

The Family plan can cover up to five adults and an unlimited number of children with a total of $5 million of identity insurance that includes child credit monitoring, spam call protection, cyberbullying and sex offender alerts. There’s even Safe Gaming software. The Family plan costs $50 a month or $32 a month ($384 annually) if a year is paid for upfront – about half of LifeLock’s comparable plan.

The company recently added a Kids plan ($13/month, $10/month if paying annually) that can protect an unlimited number of children. It doesn’t include credit monitoring or reports but has parental monitoring of social media interactions, content and site filtering. The plan includes screen time limitations as well as the ability to pause the Internet connection at any time and a look out for cyberbullying with PCs.

Aura rates an A+ rating from the Better Business Bureau. There were some billing issues noted but the company’s customer support staff appears to be courteous and effective.

Aura review: How we tested

I signed up for Aura Family coverage in the late Spring 2025. I added my personal and financial information to the web interface and set up the Aura app on my Samsung Galaxy S25 phone.

I checked on my credit scores and identity information at least every few days for three months using a mix of the app and desktop and notebook computers. I explored the features and the interface, and kept track of the alerts.

Aura review: Setup and support

Aura’s setup process took nearly 23 minutes.I went through the Safety Checklist by verifying my identity with three questions about mortgages and credit cards. My VantageScore 3.0 credit rating popped up on the interface and I was offered a download of the Windows-only Safe Gaming app.

Aura uses Plaid to monitor bank and investment accounts and I tried to set up service but it refused to send me a verification code on my first few tries. I succeeded later.

A big bonus is that Aura now has 24/7 customer support via an 800-number hotline for anything from a late night credit question to a vacation identity emergency. Every support page has a Get Help button and there’s lots of DIY assistance as well as identity-theft related articles.

Aura review: Credit scores and identity monitoring

The Aura Individual, Couple and Family services include monitoring and scores from Equifax, Experian and TransUnion. In addition to annual credit reports, the plans show the VantageScore 3.0 rating that mimics the FICO credit ratings.

The service lacks an instant or daily credit report to help spot problems or attempted fraud as it happens, although it has alerts and notifications for lots of nefarious actions. Aura can watch for duplicate charges on your plastic and spot transactions over a preset threshold.

It can warn of someone attempting to set up bankruptcy proceedings or break into your investment account and monitor the outside world for someone on the sex offender list moving into your neighborhood. The service uses artificial intelligence to tag potential cyberbullying of a child.

Aura can help with suspected fraud, like a new credit card that you don’t recognize. The service’s Experian credit lock can freeze any new transactions. It only takes a moment to flip the switch on or off.

Aura review: Insurance and services

Underwritten by Assurant, the identity insurance that Aura provides includes 24/7 White Glove treatment. In most instances, your case will be handled by one individual who has been trained in resolving identity theft issues. Once started, the case manager can deal with restitution, new identity documents and help with getting your online life back.

The Family plan I signed up for includes up to $5 million of insurance while the Couple and Individual plans include $2 million and $1 million in identity insurance. None include an extra $25,000 of ransomware coverage, however.

There’s no deductible and it covers the gamut of experiences, from outright credit card fraud to someone remotely draining your bank account. It can pay for experts like lawyers, investigators and accountants to make you digitally whole. Aura will even send you up to $2,000 a week if you miss work and up to $1,000 in travel expenses. Finally, Aura’s lost wallet coverage is a must-have for those who travel a lot (or are just forgetful).

Aura review: Notifications and alerts

The alerts available with the Aura plans are comprehensive and customizable. They can be set to be emailed or sent by SMS text messaging. There’s the expected monitoring of Social Security number, driver’s license and passport as well as alerts for duplicate credit card transactions and bank transactions over your preset threshold. Aura’s unusual transaction monitoring flags new payment attempts that are out of the ordinary and explains why they were tagged.

In addition to a home title change alert, if someone sets up an address change to divert your mail, it will be relayed to you. Over my three months with Aura, it sent me over 75 alerts, most of which were for the service finding and eradicating my personal information on data broker servers. By far, this was the most notifications of the six identity protection services I looked at.

Aura review: Interface and extras

With the choice of online access and via a phone or tablet, Aura provides freedom of choice for interacting with the service. Its web-based interface is bright, open and tinged with light blue. It not only shows covered family members but welcomes you by first name. Like the web interface, the home page of Aura’s mobile apps are essentially long narrow strips of data and links, so get ready for a bit of scrolling.

I was able to get connected and see my data in an average of 3.5 seconds using a browser. The app was slightly faster at 3.4 seconds. This was the fastest of the six services I looked at.

The Home page shows a list of recent activity, including removing identity data from brokers and any credit changes. On the right is a protection summary, the current credit score and a link to recent transactions. Below are articles, although some might appear to be out of date.

The Me page is for individuals within the family group and provides more in-depth information. The My Family area shows who’s covered and a place to add more.

It all comes together in the Vault, an area protected by AES 256 encryption for critical or embarrassing documents. There’re places to go into depth for the password manager, stored documents and properties, although it listed both my homes twice, making me feel like a property baron. I was able to see the progress of Aura removing my data from brokers as the service removed several dozen instances of my personal data.

For many, the prominent VantageScore 3.0 section will be either the high- or low- point. Click to see it with an interpretation of the numeric score as well as a fever chart of its recent movements.

Below are suggestions for raising the score, but the service lacks a credit simulator to see if paying off your credit card debt would help your credit score.

In addition to helping extricate your personal data from online brokers and a dedicated tax fraud watch, Aura’s dark web monitoring can be like a beacon lighting up the night. It looks for your personal identifiers and alerts you if your Social Security number, any financial accounts, credit cards or health information shows up.

Aura review: Antivirus, VPN, and password manager

That said, the plan includes several security-minded add-ons that together make Aura for a full security suite. In addition to malware scanning and real-time monitoring, the subscription has Aura’s password manager. Unlike some of the best antivirus software such as Bitdefender and ESET, Aura hasn’t submitted its product for testing by an independent lab, so we can’t comment on its effectiveness.

The gem feature here is unlimited VPN access for 10 systems per covered person with Hotspot Shield’s global infrastructure in nearly 90 countries, including two dozen connection points in the US. It has a kill switch and supports split tunneling.

In Aura’s app, the Calls tab let me turn on call protection that attempts to filter out calls from unknown callers, spam, scams and phishing attempts. It worked well in my three month appraisal of Aura.

Aura review: Parental controls

On top of Aura’s parental controls for restricting web sites, limiting screen time and pausing the internet for some family time, the Family plan’s latest addition is its AI-powered digital parenting tools. They seek to model what your child’s online baseline looks like and ferret out subtle changes over time that might be the start of cyberbullying, self-harm, or exposure to harmful content.

The subscription also includes the Safe Gaming app that keeps an eye on the back and forth gaming comments that might indicate inappropriate behavior or the start of cyberbullying. It only works with Windows computers, though.

Aura review: Verdict

While an excellent value compared to other identity protection schemes, Aura succeeds with a family oriented plan that has the expected parental controls but adds cyberbullying alerts and the ability to watch your children’s activities. The clan is covered with between $1 million and $5 million in identity insurance and malware protection to VPN access and access to your credit details and scores. Plus, it’s the fastest at getting to your data that I’ve seen.

It lacks any credit simulators, but the service is a bargain for all it does to safeguard a family’s identity and peace of mind. It’s for those who don’t want to sacrifice childhood security, or a full feature set, to save money.

Bringing together services provided by TransUnion and pairing them with McAfee’s antivirus protection, this identity protection and credit monitoring plan makes an already impressive security suite a lot better and more comprehensive for dealing with the age of cyber theft. Unlike others, McAfee software designers did their homework by integrating the many products and services of one of the best identity theft services into its current antivirus software offerings with a common look and coherent feel for generally easy use and navigation.

The top McAfee+ Ultimate plan provides direct access to all three credit bureaus plus a freeze on financial activities via TransUnion. It shows scores from the top three credit agencies and provides access to its inner workings via a Web browser as well as apps for the most popular computing platforms, including Chromebooks.

More than the sum of its parts, McAfee+ Ultimate comes with the company’s malware scanning and VPN access for an unlimited number of users as well as up to $2 million in identity insurance to counteract fraud as well as $25,000 per ransomware event.

With an all-in-one approach, McAfee comes close to an ideal security phalanx. The question remains as to whether you want an annual commitment.

McAfee+ review: Costs and what’s covered

McAfee has simplified the often complex act of combining identity protection with security software. Starting with the McAfee+ Advanced subscription, the plan includes the company’s malware protection and VPN access for an unlimited number of systems. It also has single bureau monthly credit scores and with $1 million in ID insurance plus an extra $25,000 reserved for a ransomware attack.

The first year costs $89.99 for an individual or $119.99 for a family that can include up to four children. After that the annual price increases to $179.99 for one and $269.99 for a family.

By contrast, the Ultimate plan ups the coverage significantly. The insurance amount rises to $2 million along with an extra $25,000 for ransomware break ins. In addition, the plan includes daily access to credit changes from all three major credit bureaus with scores, monitoring and freezes. It costs $199.99 for the first year for an individual and $399.99 after that or $249.99 a year for a family and $424.99 after the first year ends. That’s roughly half as much as LifeLock’s similar identity coverage.

Unlike the others, none of the McAfee plans offer the option of a minimal-commitment monthly plan to pay as you go, so its annual payments or keep shopping.

McAfee’s A+ from the Better Business Bureau matches the best in the business.

McAfee+ review: How we tested

I started my work with McAfee+ Ultimate in the late spring by signing up for a year’s worth of Ultimate coverage. After loading the software and entering my personal data, I checked in every other day and looked for alerts and notifications.

After three months of working with the services using a notebook, Galaxy S25 phone and Lenovo Chromebook, I cancelled it.

McAfee+ review: Setup

Getting started with McAfee’s identity protection is now one of the easiest to accomplish with a streamlined installation process. Starting at the company’s web site, I entered my email address, my payment details and accepted the license details. I declined McAfee’s kind offer to automatically renew the subscription after a year with the overly subtle link at the bottom of the payment page.

After installation, the program’s Dashboard window showed up, front and center. I set up credit and identity monitoring in one of the easiest setups around. I still needed to verify myself twice more but everything went fine.

After I started, McAfee added Scam Detector, which involved a short set up sequence that allows McAfee to monitor my email at the server level, scan videos for fakes and add the Web Advisor browser extension.

All told, it came to about 10 minutes of time to get the complete service up and running.

McAfee+ review: Antivirus features and performance

McAfee’s antivirus software is known for being both effective and efficient: it has multiple scan options to check your computer for malware, and a full scan of the machine during testing took only 35 minutes. In independent antivirus testing, McAfee has scored well. In the AV-Comparatives testing in March 2025, it scored 99.96% in detecting malware samples, and a 6 out of 6 in AV Tests Jan-Feb 2025 report.

This doesn’t slow down the system either. We found in our testing that even with McAfee’s VPN enabled, a download took the same amount of time. A full scan of 926K files took a little over a half an hour, with the other scans taking even less time to complete.

McAfee+ review: Credit scores and identity monitoring

The philosophy behind McAfee+ Advanced and Ultimate is to simplify the process of getting and using the coverage and insurance you want. Built around TransUnion credit rating and reporting, the Ultimate plan I looked at adds Equifax and Experian for a credit trifecta.

There’s also a TransUnion credit lock button for transaction emergencies.

Like the others, the McAfee subscriptions use the VantageScore 3.0 credit scoring system as a stand-in for the ever popular FICO credit worthiness scores. At the bottom there are explanations of four items that affect the score as excellent credit-improvement advice. Still, the plans lack a more formal credit simulator for more in-depth scenarios.

Meanwhile, McAfee’s Personal Data Cleanup contacts the top data brokers in an effort to find any mentions of my personal info, including fragments. The service found 10 instances and the Ultimate plan can be set up to send out data removal requests. Others charge for this service.

McAfee+ review: Insurance and services

Like some of the other identity protection services, McAfee uses TransUnion with underwriting by Lloyd’s. By contrast, LifeLock self-insures its coverage. The McAfee policy includes up to $2 million for restoration and recovery with access to lawyers, accountants and detectives to investigate and remediate an identity theft. There are provisions for lost wages and travel should you need to meet with them or go to hearings.

The bonus is McAfee’s $25,000 in extra money available to help survive a ransomware attack. It won’t pay for a new computer or its lost data if you need to scrap the affected one, but it covers the ransom cost.

McAfee+ review: Notifications and alerts

Regardless of whether you choose the Advanced or Ultimate subscription, McAfee has lots of alerts and notifications that can arrive via text messaging, email or by using the service’s interface.

The center of attention here is the bell icon in the upper right that swings back and forth to indicate there’s something that needs your attention. Too bad it doesn’t do as well.

In addition to a variety of breach alerts the McAfee identity plans will let you know if your personal identifiers appear online. On the other hand, the service can’t alert you if your phone’s SIM card has been broken into. There are alerts for credit score changes as well as major balance changes to your bank or investment accounts.

On the downside, even the Ultimate plan continues to lack any alerts for the event that someone is trying to change your home or car’s title, cyberbullying you or family members or when someone is being abused online. The service also does without sex offender monitor if someone on the state’s list moves near you. There are several apps to choose from for this.

Over my three months living with McAfee+ Ultimate, I received six McAfee alerts.

McAfee+ review: Interface and extras

McAfee’s Home screen items are in boxes, which each have large On or Off signifiers to show what’s active or a number to indicate the number of items found with your data or breaches. Happily, everything has a short explainer that can be explored in depth with a click to see the underlying data.

The Home screen also shows a snapshot of the program’s scope. These range from the number of breaches found and how many data brokers know something about you to scam alerts and credit monitoring. There’s even a place for seeing how many devices are covered by McAfee’s malware and VPN protection.

Unlike others, the McAfee interface doesn’t show your current credit score on the main page, it’s a level below with explanations of the score ranges and a credit lock button for TransUnion.

Below are the major positive and negative factors that make up the score. While McAfee continues to lack a formal credit simulator, these explanations are a big step forward in helping manage and improve credit scores.

I particularly liked the Online Account Cleanup that goes out and finds all the accounts associated with my email address. It was an eye-opener for me with services I’d forgotten about years ago though I was on my own to remove them.

McAfee+ review: Protection Score

McAfee’s Protection Score brings together all aspects of your online life, including which program features have been enabled. Over the course of my three months with the software, I boosted my score from a pathetic 570 to a reasonable 645 to rate a “Good.” I wish improving other aspects of my life was this easy.

The My Protection tab reveals the program’s main functions with everything that has been set up, ranging from Scam Detector to Identity to Privacy. In a rare design misstep, the Devices category at the bottom is truncated.

The app has tabs along the bottom for Home, Notifications and the Scam Detector. It can be a little confusing because the recently added Scam Detector has pride of place at the center in red. I often misinterpreted it as the active tab next to the gray, smaller and lower Home and Notifications choices.

The credit info is two levels below the surface, so in the final analysis, McAfee+ Ultimate will likely be frustrating for those who want their scores front and center.

McAfee+ review: VPN

The VPN allows unlimited use and has a kill switch. It provides the ability to do split tunneling and provides the choice between the fastest (presumably the least congested) online route and picking where the stream emerges from the encrypted Web traffic (for global entertainment purposes). Although the service now has 9,000 active servers, the geographic scope is more limited than competitors with a presence in 48 countries, including Moldova for the adventurous.

McAfee+ review: Scam Detector

McAfee has been using artificial intelligence for years in its malware protection products. Its Scam Detector takes this to a new level and has been integrated into the identity protection. It can warn you of text, image, video and email scams that might have been personalized to your online data profile. Using machine learning based on thousands of successful scams, the detector can ferret out the hidden danger in an otherwise innocuous text message.

Happily, it’s faster than most scam monitors. That’s because the majority of processing occurs locally rather than having to travel to cloud servers for investigation, analysis and determination as to its dangers. It took less than 10 seconds compared to more than double that for other similar products.

McAfee+ review: Verdict

The McAfee+ Ultimate security and identity protection suite not only gets our most improved award, but it has taken the lead in providing a balance between cost and effectiveness in online identity protection. It can defend a family’s digital lifestyle with the most important features and abilities that leaves others in the digital dust with access to all three credit bureau scores and reports along with a TransUnion credit lock button and $3 million in insurance. Oh, it adds an extra $25,000 to help reimburse for a ransomware attack.

Others have AI-based scam protection, but McAfee’s Scam Detector is just as effective but is faster due to its local processing. Rather than feeling like separate screens with their own style and visual language, Ultimate does a good job of harmonizing data from different sources. It also includes some of the best apps for malware protection, VPN access and password management, while adding another exclusive, a native Chromebook security app for full platform support.

There’s still work to be done because McAfee doesn’t offer monthly service and the software lacks a formal credit simulator, although the plan includes general improvement guidelines. The best part is that McAfee+ Ultimate does it all for about half the price of the market leader, making it one of the best bargains in identity protection around.

LifeLock is not only one of the oldest providers of best identity theft protection services, but it’s one that offers some of the most comprehensive coverage available on the planet. It also continues to add new features every time I turn around, but LifeLock is among the most expensive identity theft protection services.

It might be worth it because it has everything from credit monitoring and alerts to dark web monitoring, scam protection and plenty of insurance, should something go wrong. Some may chafe at LifeLock’s potentially overwhelming software and a pricing structure that can get close to $1,000 a year for a family when traditional defenses like malware scanning, VPN access and a password manager are added.

LifeLock aims to thwart just about anything the web can throw at you – and succeeds. Its lineup of products might be a bit complicated and expensive but LifeLock can do it all by protecting from every conceivable angle of attack. That is, if you can afford it.

LifeLock review: Costs and what’s covered

Providing the most extensive coverage of any identity protection service, LifeLock has a complex array of products with optional add-on Norton 360 software and several utilities. Together, they create a shield to defend you against the most prevalent digital dangers. If the choices seem hard to swallow, take LifeLock’s quiz before signing up. At the end, the site will suggest an appropriate protection level.

The LifeLock lineup starts with the Identity Advisor. It combines dark web monitoring with data breach alerts and costs $4.99 a month or $39.99 for the first year. This rises to $49.99 a year after 12 months.

The more traditional Standard plan observes action on your Social Security number and includes single bureau credit agency monitoring. It comes with $1 million for identity restoration as well as $25,000 for stolen funds and $25,000 for personal expenses spent to recover your persona – $50K more than many of its competitors.

It lacks a specific $25K for ransomware attacks, though. Standard coverage costs $89.99 a year or $7.50 a month for the first year. Starting on day 366, the plan’s price rises to $124.99 annually or $11.99 monthly.

LifeLock’s Advantage subscription ups the coverage to a total of $1.2 million and adds things like a payday loan lock and alerts if someone takes over your buy-now, pay-later account. It includes single bureau credit monitoring and costs $179.88 or $14.99 a month for the first year. After that the price becomes $22.99 a month or $239.99 a year.

The company’s Ultimate Plus Individual plan costs $239.88 annually or $19.99 monthly for the first year; after that, it’s priced at $339.99/year or $34.99/month. It increases the insurance level to $3 million with $1 million each for experts, stolen funds and personal expenses. With three bureau monitoring, reports and scores, it is built around an instant TransUnion credit lock and can alert you about social media and phone account takeovers as well as if someone is trying to steal your home’s title or your investment accounts.

There’s also a couples version of Ultimate Plus that doubles the overall insurance to $3 million for each adult. It costs $395.88 a year for the first year and $679.99 after that; monthly payments are $69.99.

Overlayed on this scheme are Family plans that can include up to five children for the Ultimate Plus plan until they reach 26 years old. While the adults get full credit reports and scores with up to $3 million in identity insurance, the kids are limited to Standard plan’s $1,050,000 of total protection and don’t get credit reports. Its cost starts at $38.99 a month (or $467.88 a year) for the first year. After that it rises to $79.99 a month and $799.99 a year.

On top of that, there’re several options for extra coverage that can close any loose ends with Norton 360 Select software. It starts with the company’s well regarded malware protection and extends to everything from VPN access and a password manager to ransomware, hacking and scam protection. Windows computers get 500GB of online storage and the software can be used on an unlimited number of notebooks, desktops, phones and tablets.

On its own, Norton 360 Select costs $190 a year but is available as an adjunct to the LifeLock protection. While the first year adds $99.99 to the total, after that it’s $159.99. This brings the total payment dangerously close to $1,000 a year for a family – double or triple the cost of other similar plans.

On top of all this are several utilities that can each add to the tab. The free Privacy Monitor scans for your personal information at data brokers and shows vulnerabilities. To remedy the situation, you’ll need the $110 Privacy Monitor Assistant to fix them.

Meanwhile, the $50 Computer Tune Up can help with balky computers and the company’s Utilities Ultimate costs $60 and promises several techniques to speed up a Windows or Mac computer.

LifeLock, Norton and its corporate parent Gen have A+ ratings from the Better Business Bureau. That said, the organization has alerted customers about cybercriminals imitating Norton and LifeLock to steal your online credentials, including emails I’ve received with fake payment invoices.

LifeLock Ultimate Plus review: How we tested

In early spring I signed up for LifeLock’s Ultimate Plus plan, set up an account and added my personal information. Over the course of three months, I used the service just about every day to check my credit scores, look for breaches and check on potential scams. At the end, I canceled the service.

LifeLock Ultimate Plus review: Setup and support

To get started, I had to share the appropriate personal information then load Norton 360’s software as well as activate credit monitoring on my main computer. I also installed the app on my Galaxy S25 phone via a QR code.

Adding data for accounts and credit cards took a few minutes and I was done. Start to finish, it took just under 12 minutes – about average for this genre.

LifeLock has lots of self-serve options on its support site, including help understanding and navigating the complex world of credit scores and reports. There’s an extensive FAQ section, lots of helpful articles and an innovative AI powered search section.

The company’s trained staff is standing by 24/7 to answer questions or start an identity breach incident. They respond to phone calls and emails as well as a link on the site and app.

LifeLock review: Credit scores and identity monitoring

Like many competitors, LifeLock checks for activity on credit cards, bank and investment accounts. It provides the peace of mind with credit locks for Experian and Equifax as well as a lock for TransUnion. It’s easy to switch either on or off with a tap or click.

There’s easy access to current credit scores with the Vantage 3.0 rating system. It’s a good stand in for the FICO creditworthiness mark. While other services allow side by side comparisons between the credit bureau’s scores, you need to move to separate pages to see the individual scores in LifeLock. Up top is a download link for the full report.

LifeLock continually scans the online world to keep an eye out for your personal information on the dark web and warns you if your Social Security number, name, address and other indicators or fragments show up. While LifeLock scans major people-search firms, like Intellius and Spokeo, to see if they have your name listed, it also looks for address changes for you as well as any changes to the title for your home.

Meanwhile, the Social Media Monitoring protection watches for indications of odd posts, cyberbullying or indications of an account takeover. It covers Facebook, Instagram, LinkedIn, X (aka Twitter), YouTube, TikTok and Snapchat.

LifeLock review: Insurance and services

Unlike the others which underwrite their coverage with a major insurance company, LifeLock self-insures its risk. This can save on overhead but might be a problem if it gets an onslaught of claims.

With $1 million to cover lawyers, consultants, experts and accountants to forensically examine the identity theft, LifeLock’s Ultimate Plus plan also provides up to another $1 million to cover credit card theft and money stolen from a bank or investment account. There’s also a million dollars available to pay for personal expenses, like lost work, travel and the cost of getting new documentation, like a passport and driver’s license.

The Couple plan doubles this to $6 million, total. LifeLock’s Family plan adds $1,050,000 of insurance for each child; it can cover up to five siblings until their 26^th birthday.

LifeLock’s Protection report makes for good reading because you’re the main character. It shows all the major security and privacy issues in one place and takes only a few seconds to be compiled.

There’s also a probing Identity review that combines the Identity Lock and credit ratings. It’s the place to download utilities and security software.

LifeLock review: Notifications and alerts

The service’s alerts that LifeLock can provide are comprehensive with notifications about data breaches and the results of dark web scanning for personal identifiers. It can find things like changes to your credit scores and account balance changes.

Should you go wild and spend over your preset transaction limit, you’ll get a notice and a suggestion to raise the limit. There are also warnings for payday loans and an innovative freeze on these types of transactions.

If a registered sex offender moves into your neighborhood or if a utility account is opened in your name, you’ll know about it. LifeLock can send these missives by SMS text, email and shows them prominently on the interface in the Alerts section.

LifeLock’s mobile app can do something the others can’t: monitor your phone’s SIM card account for signs that someone might be tampering with it.

I got a total of 20 alerts from LifeLock during my three month evaluation period. They were mostly for large (at least for me) bank transactions.

LifeLock review: Interface and utilities

LifeLock offers either a browser version or a mobile app; there are iOS and Android versions. The browser has a bright airy look with lots of yellow in it; an appreciated touch is that when you’re in a tab, it’s highlighted in yellow.

The menu items are set up as vertical tabs on the left, with options for every major feature of the service including Alerts, Credit Services, Financial Monitoring and Lock & Freeze. Its Plan Details shows your subscription information.

The mobile apps also have a bright background, lots of yellow and red to indicate a potential problem. They only work in Portrait mode and for security purposes don’t allow screenshots.

The top navigation has the essentials, including unread alerts and the current credit situation. However, there’s a lot of scrolling involved, and using horizontal elements might have helped. Below the fold are links for identity and financial monitoring as well as the Privacy Monitor.

Norton LifeLock Ultimate review: Features

Some of the noteworthy features that I checked out while testing include the Privacy Monitor which checks with data brokers and people-finding services for your data. It can request removal but you’ll need to pay $110 a year for the Privacy Monitor Assistant to make it automatic.

Quietly added last year, Ultimate Plus includes LifeLock’s Credit Score Insights simulator. Rather than concentrating on paying off credit card balances or getting new cards, it looks at the totality of your credit and the critical elements that affect your VantageScores. It included interesting analytic items like credit age and derogatory report remarks.

The latest addition is access to Norton’s Scam Protection, which checks if emails, texts or images are part of a scam. I tried it with a fraudulent invoice purportedly from BestBuy. It spotted it a mile away but took about 30 seconds to let me know.

Norton LifeLock review: Verdict

LifeLock continues to be the 800-pound gorilla in the identity protection room by trying to do everything conceivable and several I couldn’t have conceived of. In addition to credit monitoring, scores and locks, LifeLock Ultimate Plus includes up to $3 million in ID insurance to help get your life back together and its Scam Protection might be a little slow but it is thorough.

It may be comprehensive and just what’s needed in this day and age, but it can feel suffocating with all its alarms, alerts and warnings. Also, the cost of about $1,000 to protect a family’s online persona may be prohibitive to many. If that’s the case, then Identity Guard might be a better choice given it offers more affordable plans.

By combining Bitdefender’s premier security suite with TransUnion’s credit monitoring, reports and identity insurance, Bitdefender’s Ultimate Security Plus Extended takes online security to a new level by covering the most important aspects of protecting an active online lifestyle. By integrating it all into the Bitdefender Central software, Ultimate Security Plus Extended is one of the best identity theft protection services to use while also covering your devices against dangerous malware.

In addition to monitoring and $2 million of identity insurance, the service provides credit scores and reports while giving the ability to freeze your credit at a tap. Its premier viral scanning, password manager and access to an unlimited VPN for secure communications are icing on the online cake.

Happily, Ultimate Security Plus Extended does all this for roughly the price of similar services that don’t include Bitdefender’s traditional protective elements. This makes Ultimate Security Plus Extended a potential bargain that no family should do without.

Bitdefender Ultimate Security Plus Extended: Costs and what’s covered

With a traditional security suite, identity insurance and credit monitoring, Bitdefender tries to be all inclusive with several plans. It includes the company’s premier traditional protection along with TransUnion credit monitoring and identity insurance.

To start, Ultimate Security Plus Standard has the basics, like real-time protection, ransomware rollback of affected files and conventional malware scanning. The plan includes $1 million in insurance to make your online world right again in the event of an identity crisis. It includes things like payday loan monitoring and single bureau credit monitoring and reports but falls short of the mark without home title alerts.

It starts at $119.99 (or $11.99 a month) for the first year although the price rises to $189.99 annually or $18.99 a month after that. It’s a bargain for those seeking minimalist coverage that includes Bitdefender’s Digital Identity Protection.

To get three bureau monitoring, Bitdefender’s top Ultimate Security Plus Extended plan costs $149.99 per year or $14.99 a month for the first year and $249.99/$24.99 after that. The plan increases the insurance amount to $2 million and adds things like investment account alerts and change of address notifications. This top plan matches McAfee’s extra $25,000 of ransomware protection.

It lacks things like a couple plan but Bitdefender has family versions of its identity protection. The Ultimate Security Plus Standard subscription costs $179.99 a year for the first 12 months and $269.99 after that or $14.99/$26.99. The Extended version is priced at $199.99 for the first year and $349.99 after that or $19.99/$34.99 a month. Either way, these plans are roughly half the price of some competitors.

The company has a coveted A+ grade by the Better Business Bureau, while TransUnion lacks ratings by the consumer protection organization.

Bitdefender Ultimate Security Plus Extended: How we tested

In the late spring, I signed up for and entered my personal data into Bitdefender’s Ultimate Security Plus Extended interface. Every couple of days, I checked for credit changes, dark Web scans and other features for three months using notebooks, tablets and phones. At the end I cancelled the service.

Bitdefender Ultimate Security Plus Extended review: Setup

I started by creating an account and installing the software. Along the way, I needed to verify my existence several times.

After the service collected information about me, the dashboard popped up and I needed to add my personal data and then authenticate it with TransUnion. This was followed by entering my Social Security number twice and verifying (once again) myself with a text message code.

Nearly done, I added my social media accounts for monitoring, abuse and cyberbullying. The service covers FaceBook, Twitter (aka X), Instagram and YouTube. It ignores Linkedin, WhatsApp and TikTok, however.

I finished by loading the app on my Samsung Galaxy S25 phone. All told, it took nearly 13 minutes, half the set up time I encountered the last time I used the product.

Bitdefender Ultimate Security Plus Extended: Credit scores, reports and monitoring

Using IdentityForce as a credit score and monitoring provider frees Bitdefender to concentrate on what it does best: hunting malware and protecting a system’s integrity. On the downside, while the others have a common user experience, Ultimate Security Plus Extended has several different looks, depending on what you’re doing.

The downside to this means that to get to the identity services, the system has to connect with the internet to get to IdentityForce. The data is fully encrypted for security.

The base subscription includes monitoring and credit reports from TransUnion but my Extended account ups that to include Equifax and Experian for full three bureau coverage. While I was not able to get an instant credit report, they are available on a quarterly basis, not monthly as is the case with many competitors.

There’s daily access to updated Vantage 3.0 credit scores that parallels the computations of the FICO rating. I like the fever chart of its changes over the last several months. At any time, I was able to start a credit freeze with TransUnion or turn it off with a click.

While it would have been overkill for me, Ultimate Security Plus Extended can track up to 10 bank and investment accounts. It looks after key personal info, like driver’s license, passport and credit cards. The plan recently added payday loan monitoring but still does without home title alerts if someone is trying to steal my home with fraudulent paperwork. It promises to alert me to an address change that might be a warning that something’s amiss.

Bitdefender Ultimate Security Plus Extended: Insurance and services

With up to $2 million of identity-theft insurance and restoration experts on call, Ultimate Security Plus Extended mirrors others in this crowded market. Underwritten by Lloyd’s, it lacks the ability to increase the coverage to $5 million for a family.

This area is covered by TransUnion to take into account the gamut of activities needed to get your life back. The help should be all you’ll need other than patience. There’s help from specialists like accounting, investigative and legal services to do things like getting a new passport and driver’s license.

The plan will reimburse you for up to $2,000 for travel and pay you $1,000 a week in lost pay to go to hearings, meeting with experts or any other restoration activity. On the other hand, the coverage includes an extra $25,000 of ransomware insurance, matching McAfee’s treatment.

Should your wallet get lost or stolen, Bitdefender can help with cancellation of recorded credit and debit cards as well as starting the process for getting new ones. It lacks emergency cash to get whole if you’re on the road, however.

Bitdefender Ultimate Security Plus Extended: Notifications and alerts

In addition to the expected text and email alerts, Ultimate Security Plus Extended shows if you have any notifications that haven’t been looked at or addressed. They reside behind the bell in the Bitdefender Central interface’s upper right. Open it to see what the details are and if any remediation is needed.

The range of alerts is wide, including anything from dark web scans for your personal info to covering court proceedings, like a bankruptcy. The transaction alert has a threshold that can be set for any amount: too low and it’s overkill; too high and you might miss some fraud.

My three months with Bitdefender Ultimate Plus yielded 22 alerts. Of them, three were my monthly security reports.

Bitdefender Ultimate Security Plus Extended review: Interface and Extras

Bitdefender offers mobile apps for iOS and Android and a web-based interface, the identity theft portion is only available through the online version of Bitdefender Central, making it a little harder to quickly get to the right data.

In the web browser, the Bitdefender central dashboard covers everything, including covered systems and current threats on the main page while the app doesn’t include credit information.

The tabs along the left add access to features like the SecurePass password manager, VPN and credit scores. The center of attention is the Identity Theft Protection section, although it was slow to load these details. The Hub sums everything up, from credit scores and access to a restoration specialist to help with a stolen wallet and social media monitoring.

The Tabs include categories like credit scores, the encrypted vault for your personal info and access to the Breach IQ details. There’s also places for Support and extra resources, like credit card and loan comparisons.

Switching to the Bitdefender app on my Galaxy S25 phone is easy, although the dark mode can be a bit oppressive. The dashboard shows how many devices are protected, the number of blocked threats with the parental controls and Security News items.

While the Devices tab at the bottom shows details for protected devices, the Notifications displays unresolved items, like dark web scans or configuration details. The More tab has a Network Scan feature that interrogates the current Wi-Fi connection and delivers the local and external IP addresses along with the number of devices online.

Bitdefender Ultimate Security Plus Extended review: Features and antivirus protection

I used the service’s BreachIQ feature often to see if my data was being exposed. The program not only provided me with an identity Safety Score (mine was an 85) but shows data leaks along with the date and a rating. Ultimate Security Plus Extended can help with actions to mitigate exposure and tracks them but lacks the ability to wipe personal data from brokers.

In addition to dark web monitoring for my personal info, any of the Ultimate Security plans provides access to Bitdefender’s Scam Alert, an AI-powered utility that analyzes text, images and audio to tell the difference between legit software and fraud. It takes upwards of 30 seconds to perform the analysis.

A big step forward for Bitdefender is the added Credit Simulator. It not only lets you try out scenarios for paying off debt quickly or slowly but can factor in new credit cards and extra credit enquiries.

In addition to Bitdefender’s world class malware and ransomware protection, Ultimate Security Plus Extended includes Bitdefender’s VPN, which provides secure access in over 110 countries, including out of the way places like the Isles of Man and Jersey; there are 20 connection points in the U.S. alone.

Its new SecurePass password manager can store an unlimited number of log-in credentials and store them in encrypted form, while the included Digital Identity Protection plan can find your data on the dark web (if it’s there) and check if data breaches matter for you.

Bitdefender Ultimate Security Plus Extended review: Verdict

By pairing the latest in identity protection from TransUnion with Bitdefender’s leading malware protection software, the company’s Ultimate Security Plus Extended does a good job of covering all the bases. It includes the company’s world-class malware defenses, password manager, scam alerts and VPN access, but swings a little too far towards traditional antivirus defenses.

While it covers the credit world well with three bureau monitoring and a credit freeze button, there’s no home title change monitoring and the slow response can be someplace between annoying and frustrating. Plus, the reports are available quarterly and many of the newer elements use differing interfaces.

For Bitdefender, our verdict is “nice try,” but it’s time to integrate the various elements of Ultimate Security Plus Extended better to make it seem like it’s all cut from the same cloth.

With a focus on identity protection that none of the other best identity theft protection services can match, TransUnion’s IdentityForce offers a good mix of credit scores and advice with identity insurance. Bitdefender and McAfee even use the service for their own products. IdentityForce plans are reasonably priced and inclusive while the included credit simulator is among the best ways to try out scenarios for improving scores.

The IdentityForce plans, however, have fallen behind the pack when it comes to comprehensive protection. They not only lack the malware defenses offered by competitors but the service’s VPN only works with the mobile app. Still, IdentityForce UltraSecure+Credit offers an array of identity defenses and insurance for a mid-priced subscription.

IdentityForce UltraSecure+Credit: Costs and what’s covered

IdentityForce is part of TransUnion, one of the Big Three credit monitoring agencies, so if you get one of their plans, you are going right to the source for credit data, monitoring and financial protection. There’s a 30-day trial for the two mid-priced plans, starting with the UltraSecure subscription that includes everything from fraud and dark web monitoring to mobile app VPN access. It includes up to $1 million in identity insurance and restoration specialists on standby to make you and your online life whole again. UltraSecure has security utilities that augment but don’t replace traditional malware software, so for complete coverage you’ll need to also get a security suite.

Getting individual UltraSecure coverage costs $9.90 a month or $99.90 for the first year. After that it costs $9 more. The Family plan, which covers two adults and an unlimited number of children up to 26 years old, costs $15.90 a month or $159 a year, a first year savings of $15. It also has TransUnion’s ChildWatch to keep an eye on your offspring’s social media accounts, and Social Security data while monitoring bank account activity.

IdentityForce’s UltraSecure+Credit is a big step up at $19.90 a month or $199 a year for an individual or $23.90/$239 for a family. UltraSecure+Credit takes identity protection up a rung with credit scores and reports from the top three bureaus. There’s an instant daily TransUnion report of updates to your credit status as well as quarterly reports from Equifax and Experian. The insurance level is doubled to $2 million and the plan includes phishing and botnet protection but nothing for traditional malware detection.

Either way, the pricing is in the middle between the dirt-cheap Bitdefender plans and the expensive ones from LifeLock. Oddly for companies that have been in this business for years, neither TransUnion nor IdentityForce have a Better Business Bureau rating.

IdentityForce UltraSecure+Credit review: How we tested

During the late spring, I signed up for IdentityForce UltraSecure+ Credit and entered my information. After that, I checked in on nearly a daily basis to obsess over my credit score, breach alerts and other identity indicators. After three months, I canceled the service.

IdentityForce UltraSecure+Credit: Setup and support

To get IdentityForce and TransUnion protecting my identity, I entered my address and a password for the account as well as answers to three challenge questions to revive the account if I forget my password. I set up two-factor authentication with my Samsung Galaxy S25 phone.

I hit a snag after entering my Social Security number with the interface telling me there wasn’t enough information to finish, and I had to call IdentityForce. In a minute it was fixed, though I did have to hold for a few minutes beforehand, and I was soon looking at the dashboard and my credit scores. Later, my credit reports were unavailable – again, fixed with a quick call.

While it took two days to get fully set up, the actual work only amounted to only about a half an hour. On the other hand, half of it was taken up by installation detours.

IdentityForce UltraSecure+Credit review: Credit scores, reports and monitoring

With the power, data and monitoring of TransUnion behind it, IdentityForce’s credit and identity products are among the best and deepest in the business. The same goes for Bitdefender Ultimate Security and McAfee+ Ultimate, which use a different mix of IdentityForce features that are delivered as a service provider for their products’ identity defenses.

In addition to the expected instant scores for the Vantage 3.0 credit worthiness score that mimic the more popular FICO scores, the UltraSecure+Credit’s Credit Score Tracker is a fever chart of changes over the year.

There’s also a TransUnion Credit Lock button to stop any transactions. The interface has links to stop credit for the Equifax and Experian credit bureaus as well.

The UltraSecure+Credit plan has transaction alerts for spending that rises above a preset threshold and the service examines healthcare payments and payday loan companies for any indications of fraud or abuse. On the downside, neither plan includes home title change monitoring, an increasingly popular crime these days. IdentityForce will let you know if someone has sent in a change of address form, which can be an initial step in someone trying to steal your home.

IdentityForce UltraSecure+Credit: Insurance and services

IdentityForce includes between $1 and $2 million of identity-theft insurance, depending on the plan. It is underwritten by Lloyd’s and the coverage does not have any deductibles. The service starts with a variety of help from experts like lawyers, accountants and investigators to get to the bottom of your identity theft and start to rebuild your life.

In addition to covering lost funds from theft or fraud, the policy includes reimbursement for things like getting a new driver’s license, passport and other documents. It can compensate you for lost workdays, travel and childcare if you need to go to hearings and meetings. IdentityForce has a crew of trained and certified agents ready to handle your identity crisis. They are available 24/7.

Plus, if your wallet is lost or stolen, IdentityForce has your back. It can quickly cancel your credit cards but not advance your money to get home if you’re traveling.

IdentityForce UltraSecure+Credit: Notifications and alerts

IdentityForce didn’t skimp on alerts and notifications about your personal data. The range includes everything from your Social Security number or email address to your name showing up on court records.

The alerts can be sent via email or text messaging. The web and mobile app interfaces also have places to check to see if there are alerts pending with additional details.

The service monitors your credit cards and bank accounts but unlike other services it does so at the online account level and requires filling in your online account credentials. It can alert when a transaction exceeds your preset threshold.

The notification works for someone trying to take out a payday loan in your name but lacks the depth to watch for fraud using your medical records. If someone on the state’s sex offender database moves into your area, an alert pops up.

Over the spring and summer, IdentityForce alerted me 64 times. The majority of them were for results from its ongoing dark web scanning.

IdentityForce UltraSecure+Credit: Interface and extras

IdentityForce’s dashboard squeezes a lot of data into a small place, by hiding tabs when they’re not needed. Just tap the three line hamburger logo and they pop out on the left with for major sections: Identity Vault, Breach IQ, Alerts, Credit and Transactions. There are also sections for Resources and Support.

The dashboard holds key information including recent breaches and lots of details about your digital life and IdentityForce’s protection. For instance, the credit scores are all there as well as the tracker with the choice of a fever graph or a chart of numbers. There are also links for Credit, Transactions, Resources and Support.

IdentityForce’s app has a Home screen that’s all business with a stack of key data arranged in horizontal rectangles. Each opens up at a tap with more data, like a credit summary and history beneath the credit scores. The data starts with open alerts and extends to the three credit scores and Safety rating. Recent transactions are at the bottom.

At the bottom is the app’s Education Center with evergreen articles and advice. Ironically, while others cram as much data onto the app’s screens, IdentityForce’s app has an open area at the bottom.

Meanwhile, the Alerts show what TransUnion came up with when scanning for your personal information and the Vault shows what it’s monitoring for. There’re top line tabs for the password manager, help with a lost or stolen wallet and a place to securely stash documents and images.

IdentityForce UltraSecure+Credit review: Features

Of the features I used extensively, two stood out including the BreachIQ service where you can find out about vulnerabilities with a Safety Score. I scored a miserable 59 and might need to go to online safety summer school. It also shows when a company you’ve been associated with has had a data leak you should be concerned about or if your personal data has leaked. More importantly, the IdentityForce subscription can show what to do about it but doesn’t automatically plug the leaks.

IdentityForce’s Credit Simulator is among the best and can help those seeking to improve their ratings by making changes to credit and buying habits. It has places for dozens of items rather than a few that include adding or deleting credit cards, transferring balances and paying everything off. The results show up in a few seconds.

IdentityForce UltraSecure+Credit review: Verdict

In depth monitoring, scores and advice about everything to do with credit are the driving forces behind IdentityForce. With its links to TransUnion, it does many of these things better than the others, but the service’s VPN is only for phones and tablets and I was waiting for a long time for the app to make its data connection.

Its credit simulator and freeze button and depth of data about credit are among the best in the business. Too bad it lacks the malware defenses that others provide, so you’ll need to get a security suite for the full protection you and your digital home deserve.

With the ability to monitor the totality of your credit, limit rogue transactions and keep an eye on your investments, IDShield gets off to a great start for protecting your identity. It’s among the least expensive of the best identity theft protection services of its kind and provides the basics, including up to $3 million in identity insurance, and a slew of security software from Trend Micro. The top plan, however, not only lacks access to your full credit reports but only shows scores from Experian, although it monitors the action at all three credit agencies.

The product can help surface data broker accounts with your personal identifiers and scrub them while the company’s Reputation Manager breaks new ground in this genre by scanning your social media accounts looking for inappropriate activities, like college partying. Yes, it can help sanitize your online persona.

On the other hand, IDShield has neither credit simulators to see how paying off all your bills at once might help your scores nor a credit lock for identity emergencies. Plus, none of the company’s plans have home title monitoring.

IDShield could be for those on a tight budget who want essential protection and a few well-chosen extras.

IDShield review: Costs and what’s covered

IDShield has four main products that can cover an individual or family digital presence with $3 million in identity insurance. To start, the Individual plan costs $14.95 a month for single bureau scores and monitoring from Experian and $19.95 a month for monitoring from Equifax and TransUnion as well.

There’s no annual discount, however, and IDShield has an honest approach to pricing without an initial sign up discount. It costs a little more upfront but there’s no increase after your first year.

Getting the family plan covers two adults and up to eight children until they are 26 years old. Single bureau monitoring costs $29.95 a month while upping that the three bureau access costs $34.95 a month.

While all the plans include Trend Micro security software, identity insurance, extensive monitoring options and dark Web and social media scanning, none of the IDShield plans include access to annual credit reports. Others do this on a weekly, monthly or daily basis but they are available for free annually from annualcreditreport.com.

Part of LegalShield, IDShield is owned by PPLSI that offers a variety of subscriptions for identity protection and legal services. The Better Business Bureau gave it a well-regarded A+ rating.

IDShield review: How we tested

In the Spring of 2025, I signed up for six of the top identity protection services, including IDShield. I entered my personal information and loaded the Android mobile app on my Samsung Galaxy S25 phone. Over three months I checked in frequently to look at my credit score and online warnings and alerts. When I was done, I cancelled the service and got on with my life in the real world.

IDShield review: Setup

The setting up of IDShield coverage was easy to accomplish. It started at the company’s web site where I picked Family coverage, followed by viewing the two plans and picking the three bureau approach. Interestingly, unlike the competition, the $34.95 price is what I’ll pay for the foreseeable future because there’s no first year discount.

After I looked over the possible plans, I clicked on Get Started and entered my email address.

Next, I typed in a username, followed by my personal information, including the last digits of my social security number. The service was “unable to authenticate me, and I finished up proving I was in fact me over the phone with IDShield’s tech support people. During anxious moments, IDShield’s call desk person was a calming influence.

All told, it took about half an hour and I was able to see my credit score and enter the data concerning my passport, driver’s license, credit cards and bank accounts.

I added a few extra email addresses and phone numbers I use and the data for my LinkedIn account.

The support crew are there from 7 a.m. to 7 p.m. (Central Time) on weekdays but IDShield has restoration experts who are on call 24/7 to help with a question or an identity crisis. They were courteous, knowledgeable and, above all, reassuring.

IDShield review: Credit scores and monitoring

Regardless of which service you sign up for, IDShield does a good job of monitoring and delivering your Experian credit score. The plan does monitor your credit at TransUnion and Equifax as well for large transactions and attempted fraud.

Regardless, you’ll get a Vantage 3.0 score that is the functional equivalent of the well-known FICO score. A weakness is the lack of full credit reports. This is something that others provide daily, monthly, quarterly or annually. You can get your credit report from annualcreditreport.com for free every year and IDShield provides a direct link.

Up to 10 Social Security numbers are monitored, including those under 18 years old for the Family plan. The alerts also include if a child’s Social Security number is used to start an account, credit application or loan.

IDShield continually scans the dark web for instances of your personal identifiers as well as keeping an eye on access to your medical records and action at payday loan establishments. The service lacks a mainstay of identity protection: tracking of your home’s title to alert you of any changes that might be an indication that someone is trying to steal your property through fraudulent paperwork.

The company operates a white glove restoration service to help financially and psychologically in the event of an identity takeover. A single representative will be your case officer and see you through the hard times.

IDShield review: Insurance and services

With insurance underwritten by AIG, all IDShield plans cover up to $3 million, although stolen funds have a $1 million limit. It, however, does without the extra $25,000 of coverage that others, including McAfee, provide to cope with a ransomware incident.

There’re no deductibles and the coverage includes theft and fraud as well as the cost of restarting your life. It can be used for getting a new driver’s license, passport and other key documents.

The best part is that the company can marshal an army of experts to dissect the attack, clean up after it and make your life whole again. This includes lawyers, accountants and private investigators. They often advise and work with law enforcement and collection agencies to help with the restoration.

In addition to lost wages and travel costs, the plan can cover child or elder care if you need to attend meetings or hearings. There’s also lost wallet protection, and the service can help cover your paycheck, up to $7,500 if you have to miss work

IDShield review: Notifications and alerts

With the choice of seeing and reading alerts via the app or browser, IDShield will also send them via email. Starting later this year, IDShield will send out a monthly summary of all alerts to its subscribers. The alerts are all adjustable and if they prove to be too distracting, there’s an Unsubscribe All button.

The dark web monitoring is a must-see. It lists places where your personal identifiers (or partial matches) have shown up online. I had four hits immediately, and a couple after using the service for a month or two.

Along these lines, my favorite IDShield service is the company’s Privacy Check, which works with data brokers to find instances of your information that have already leaked out. The service can try to remove them as well. It found a dozen instances of me and my family’s data being out in the open. On the other hand, four required follow up action on my part to remove the data.

There’s also the Sex Offender alert for any matches with the locality’s offender list living in your area. It has a nice map with the ability to set a radius, show the actual location and send an alert if someone new moves in. Unfortunately, IDShield lacks any monitoring for indications of cyberbullying of your children.

In addition to registering a mobile phone number to get alerted if someone tries to spoof it, the IDShield plan includes Social Media monitoring and notifications if a hacker has compromised your credentials. It works with FaceBook, X (nee’ Twitter), Linkedin and YouTube, although it no longer supports Instagram.

A level below the surface, the Financial Account Monitoring section keeps an eye on your bank and investment accounts. It can monitor an unlimited number of accounts, from checking to retirement.

The service showed me 6 alerts over the three months I used IDShield, mostly scan results.

IDShield review: Interface and extras

With the choice of a web-based interface and mobile apps for iOS and Android, IDShield has its interactions covered. Happily, they look similar and can both be used at once.

Starting with the browser user interface, IDShield was fast on the online draw, taking just 2.9 seconds to connect and show its stuff. The app was a little slower at 7.5 seconds.

IDShield presents a bland but functional look dominated by white, gray and pink. Unlike previous efforts keeping the zoom level at 67 or 75% is fine, although some pages do require some scrolling up and down.

The Home page has a wealth of information, including the current credit score, ability to change the alert settings and a look at your alerts. The tabs on the left lead to Credit, Security, Inbox and Account info.

The all-important Credit page shows any outstanding alerts followed by the current credit score and a fever chart of recent movement. At the bottom are ways to set up payday loan monitoring and include your investments in the coverage. There’re also some useful articles on your credit score and what affects it.

Meanwhile, the Security tab’s Overview has recent dark web monitoring alerts as well as what identity elements have been scanned for and the results. The bottom has links for all security-related aspects of IDShield and more helpful articles.

IDShield’s Internet section has its innovative Reputation Management that can save embarrassment and maybe your career by tracking your presence online and providing a score of what’s out there that might be damaging. It can’t change history but might make the past disappear, including photos from frat parties, social media posts about conspiracy theories and uploaded content on a variety of weird topics.

I rated a mid-range 400 score, which hopefully relates to an under the radar boring online persona. The service offered an explanation of the score as well as some helpful advice on being a more rounded individual online. It even offered to scrub my social media presence.

There’s also a place to get the included malware protection, password manager and VPN. These come from Trend Micro and they all require separate downloads, activations and have different interfaces.

The VPN is a step or two behind the others with connection points in only 15 countries. There are three in the U.S. for east, central and west. It can be set to always be on.

The Inbox is for alerts while the Account tab leads to details about your subscription. A big bonus is a direct link to the tech support people at IDShield. For those who need a discount to buy anything, the Member Perks section has deals with companies like Samsung, Verizon and Disney.

Brighter with more color, the app interface squeezes a lot into a small screen. It only works in portrait mode and each area mimics the browser’s approach, with the Home page showing alerts and credit scores.

It has the same tabs, but they are along the bottom of the screen.

IDShield review: Verdict

Offering a lot for a little, IDShield comes close to being the best compromise when it comes to securing your identity and home computers on a tight budget. It monitors all three credit bureaus and provides Experian credit scores but flags on delivering full credit reports.

Its access and action is fast and the package is a bargain at $35 a month for a family, including malware protection, a password manager and access to a worldwide VPN. The company could stand to expand its choices by offering a discounted annual plan, but that’s up to them.

The standouts include a reputation manager to find and delete embarrassing material online but the service doesn’t track a home’s title and there’re no credit simulators. It’s clearly for those who value every dollar and need to squeeze each and every one of them.

Editor's note: We received a statement from VTEXT to clarify details within this article and have updated this article with quotes from the company's official statement as well as additional details to reflect the most updated information possible.

A major e-commerce company, VTEX, has been affected by a data leak that involves the personally identifiable information and sensitive data of more than 6 million people for more than half a year, according to an investigation from Cybernews. This is particularly concerning with a major shopping event like Amazon Prime Big Day Deals going on, as there will likely be even more scams, phishing attacks and fraud attempts.

Cybernews first noticed the incident more than six months ago, but the company had no response when the publication attempted to contact VTEK. In it's official statement, the company has stated that the leak did not involved VTEX systems directly but those of a third-party company which then "confirmed the leak in their internal system and ...implemented corrective measures." In their original story Cybernews reported that the database remained exposed online after it had alerted the company of the leak.

In February of this year, Cybernews researchers said they found that VTEX had unknowingly uploaded a very large amount of their users data to the open internet. This occurred because of an unauthenticated container — basically, human error which caused a cloud storage environment to be misconfigured or left open without a password. Private data was then visible and accessible to anyone online who searched for it.

VTEX has stated their investigation has confirmed that VTEX "infrastructure and systems remain secure," and that there "were no anomalies in VTEX environments." It has assured customers that "your data was not affected by this reported leak."

Personal and sensitive information like email addresses, physical addresses, phone numbers, purchase history and order details were leaked for more than 6 million customers. The data is contained in Parquet-formatted files, which is a data storage format used to organize large datasets for company analytics or for organizing customer data.

In response, Cybernews posted their findings and contacted the Brazilian CERT in order to attempt to rectify the situation and secure the data. As the news outlet points out, though, this is particularly important during a huge sales event like Amazon's Prime Big Day Deals as more people are shopping online than usual.

VTEX powers 3,500 online stores and is used by major brands like Walmart, Sony, Samsung and more. They have clients across 38 countries, and are responsible for global commerce so this could have a wide ranging impact.

How to stay safe after a data breach

More from Tom's Guide

• These are the best Amazon Prime Day antivirus deals on packages for five devices (or more)
• Unity just patched a serious security flaw - update your games and apps now
• Discord users suffer the first high-profile age-verification hack – and it's unlikely to be the last

ExpressVPN has long been considered one of the best VPNs. It's a big industry name and is consistently at the forefront of VPN innovation – while being easy to use, even for VPN beginners.

At the start of September 2025, ExpressVPN overhauled its plans and pricing. Its one-size-fits-all approach has been replaced with a tiered structure. Three plans are offered at three different price points, each designed to appeal to certain users.

Previously costing $4.99 per month, ExpressVPN was never one of the best cheap VPNs. It still can't really be considered "cheap" but prices now start at $3.49 per month, making it more affordable.

This price change also brings it closer in cost to its competitors – notably NordVPN (from $3.09 p/m) and Proton VPN ($3.59 p/m).

NordVPN, along with Surfshark, operates a tiered structure. Proton VPN and most other major VPN providers offer just one tier of plan.

There are positives and negatives to tiered pricing but they're broadly a good thing, and mean you only need to pay for what VPN features you'll use.

However, I'm wondering whether ExpressVPN's implementation of tiered pricing actually hinders the provider more than it helps it.

Is it good value or has the move played into NordVPN's hands? Let's discuss.

What has changed?

This article is not a comment on whether tiered pricing is a good or bad thing. ExpressVPN has very valid reasons for splitting up its VPN offering.

In its announcement, the provider said the internet and our privacy needs have changed since its launch in 2009. It said "one plan can't serve everyone equally anymore," adding that the new mode gives you "the flexibility to choose the protection that matches your life."

The provider is correct in saying this and its new structure does offer variety of choice. But I think in doing this, ExpressVPN loses some of its appeal and I'm struggling to see what might make new subscribers choose ExpressVPN over one of its competitors.

There's no denying ExpressVPN used to be very expensive and a $1.50 per month price reduction is great. However, for $4.99 per month you received everything ExpressVPN had to offer. All its impressive extra features were bundled into one plan and this made it a real standout compared to NordVPN and others.

Features included the Keys password manager, threat protection, parental controls, eSIM data, and the Identity Defender suite.

We were really impressed and in November 2024 asked if ExpressVPN had become a bargain. Identity Defender, which provides you with ID and credit monitoring, monthly credit reports, ID theft insurance, and data removal services, was the clincher – however it is a US-exclusive.

There isn't actually a NordVPN plan that includes all of these features. Its identity protection equivalent, NordProtect, is included in NordVPN Prime (~$7 per month) but it's also a US-exclusive.

The only plan to feature a data removal service is NordPVN Ultra (~CA$8 per month) and this is only available in Canada and parts of Europe. NordPass password manager and Threat Protection Pro are included in all plans except NordVPN Basic.

With ExpressVPN you could get all these extras for less. Some features like Double VPN, Onion over VPN, and the now axed Meshnet were exclusive to NordVPN – its threat protection was also superior.

But ExpressVPN's old plan packed a punch and its wider cybersecurity suite made it stand out.

ExpressVPN Advanced provides the best value

Let's start with ExpressVPN Advanced. It's most similar to the ExpressVPN of old and the plan I'd say most people will gravitate towards.

It's $4.49 per month for 28 months of protection and includes almost all of ExpressVPN's extra features. You'll get three days of unlimited holiday.com eSIM data, Keys, an Aircove router discount, and most of Identity Defender – you don't get monthly credit reports or data removal.

The number of devices protected is 12 (up from eight) and all Advanced Protection features are present.

If you're an existing customer, you'll get almost everything you're currently paying for, with an increased device limit, and for $0.50 per month less.

I think this is the biggest takeaway. For most of ExpressVPN's exisiting customers, especially those outside of the US, ExpressVPN Advanced is good value.

If you're in the US, its value depends on what Identity Defender features you use, if any.

For those that enjoy the data removal services or monthly credit reports, you'll have to pay over $2 per month more for the privilege.

NordVPN Plus is comparable and currently costs $3.99 per month. Less separates these two plans, with ExpressVPN protecting more devices and boasting ID protection.

They both offer threat protection, post-quantum encryption (PQE), and a password manager, but NordVPN does have more directly VPN related features like Double VPN.

As a new customer, I can see the appeal of ExpressVPN Advanced, but I can also see why you'd pick NordVPN. It hinges on the Identity Defender features, and therefore whether you live in the US.

If you do, and want them, ExpressVPN edges it. If you don't, NordVPN will probably serve you better.

ExpressVPN Basic is still too expensive

The largest criticisms of the old ExpressVPN plan was paying for features you may not have wanted and the price was therefore very off-putting.

This has been corrected, with ExpressVPN Basic costing $3.49 per month for 28 months of protection.

The plan gets you all core VPN features, such as 3,000+ servers worldwide, VPN obfuscation, PQE, the Lightway protocol, and ExpressVPN's RAM-only TrustedServer technology.

There's also DNS-based ad-blocking and the number of devices you can protect has risen from eight to 10.

If you're an existing customer who's familiar with ExpressVPN, its product, and doesn't use any of the extra features, then you could downgrade your subscription. You'll keep the VPN functionality, increase your device protection limit, and save $1.50 every month.

If you use the extra features, this plan definitely isn't for you.

But I'm struggling to see how new customers would choose this plan over one offered by a competitor. Obviously ExpressVPN Basic isn't the leading plan but for what you get, it still feels too expensive.

If price is a big factor for you, then you'll likely be drawn to Surfshark ($1.99 per month), PrivadoVPN ($1.11 per month), or even Private Internet Access ($2.19 per month) if you're more of an expert. These providers offer more features than ExpressVPN Basic for less money.

We love ExpressVPN's apps. They're super clear and simple, and you may be happy to pay a bit more for that ease of use. But if you just want a VPN to unblock content and protect your data, cheaper and more feature-rich providers are available.

ExpressVPN Basic is $0.10 per month cheaper than Proton VPN, but Proton VPN is faster in most cases – in our latest tests, it topped our fastest VPN list. ExpressVPN's Lightway Turbo did record the fastest single connection, but it's only available on Windows VPN apps.

With Proton VPN, you'll also get a few more extras, such as Secure Core servers and anti-censorship features.

Aside from its simplicity, it's also hard to justify picking ExpressVPN Basic over NordVPN Basic. They're very similar, protecting the same number of devices and offering post-quantum encryption. However, the presence of NordVPN's Double VPN, larger server network, and cheaper price gives it the edge over ExpressVPN.

ExpressVPN Pro is great but only for a few users

We return to the issue of US-exclusivity when discussing ExpressVPN Pro. It's a pricey $7.49 per month and for this you'll unlock everything ExpressVPN has to offer.

There's all features from previous plans, plus the monthly credit reports and data removal services that make up the full Identity Defender suite.

You'll be able to protect up to 14 devices on one plan, benefit from five days of unlimited eSIM data, and grab an Aircove router discount worth up to 75%.

The final, and arguably biggest, addition to this plan is Dedicated IP. Usually an optional paid add-on, Dedicated IP gives you a unique, fixed VPN IP address. Nobody else can use this IP address, your VPN performance may improve, and you'll likely see fewer CAPTCHAs.

No other leading VPN provider includes a dedicated IP in its plans, with Proton VPN and Mullvad VPN not offering it at all for personal users.

The add-on costs between $3.99 and $8.99 per month, depending on plan length, so its inclusion is great value if you're after a Dedicated IP. If you then also live in the US, it's even better value as you unlock all of Identity Defender.

Only a small number of users fit into both categories though. If you don't want Dedicated IP, it's hard to justify $7.49, even more so if you don't live in the US.

I think this is likely the point. It's not designed to be a widely adopted plan and serves a select few. ExpressVPN has said how Dedicated IP has been one of the most highly requested features from its community.

However, if you are in the US and after total ID protection, ExpressVPN Pro does challenge NordVPN Prime and its NordProtect ID features. NordVPN Prime is $0.50 cheaper and has a superior core VPN, but it protects fewer devices and doesn't come with Dedicated IP or data removal.

Nevertheless, the biggest issue for non-US users is there isn't anything to replace Identity Defender – for now at least. NordVPN offers alternatives to NordProtect for its most premium plans or doesn't offer an equivalent plan at all.

In the absence of Identity Defender, ExpressVPN's plans feel a little too expensive and don't seem strong enough when compared to competitors.

What next?

Clearly, the issue of Identity Defender's US exclusivity was present before the switch.

You could easily make the argument that ExpressVPN wasn't good value for non-US customers then either. At least now they do have the option of a cheaper plan.

ExpressVPN Advanced is the best value. Overall you're getting more for less. ExpressVPN has a dedicated user base and the changes best suit existing customers.

My question is whether that's enough.

I'm concerned that ExpressVPN has somewhat lost its USP by creating the tiered system. The differences between it and NordVPN have gotten smaller and I think it actually makes NordVPN look more attractive to new customers.

Although, others may disagree.

When you remove Identity Defender, NordVPN looks like a better package, costing less money – so how you view Identity Defender is crucial.

Reducing its current pricing a little or offering an alternative to Identity Defender may be a way forward.

It's worth reminding you that all ExpressVPN plans have a 30-day money-back guarantee. You can try any plan and request a refund if you don't like it – the same goes for all major providers.

ExpressVPN confirmed that no existing users will be downgraded and legacy subscriptions remain uninterrupted. You'll keep everything you've paid for until your plan expires. Only then will the new tier structure come into play.

It will be very interesting to see how holiday sales affect ExpressVPN's pricing. Black Friday 2025 isn't far away and we expect ExpressVPN to slash its prices – but other providers will too. A significant price drop could make these plans far more attractive.

This structure is also in its infancy and we may see ExpressVPN make changes. We'll be keeping a close eye on how the provider moves forward.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

TransUnion, one of the top three credit reporting agencies in the United States, has been involved in a data breach that exposed the personal information of more than 4.4 million people.

According to reporting from Cybernews, the breach did not directly target TransUnion itself but occurred through a third-party vendor on July 28th. TransUnion realized there had been a breach two days after the incident.

Over 4.4 million customers may have had their personal details exposed. According to the company, exposed details were limited to ‘specific data elements’ which would vary from person to person and TransUnion itself may not even know what those details may be. Though TransUnion is working with both law enforcement in an investigation and with third-party cybersecurity experts in an independent forensics review.

In a letter submitted to the Maine Attorney General’s Office, TransUnion stated that the hackers did not access customers' credit information. TransUnion is in the process of notifying the affected customers with a data breach notification; this letter states that “a cyber incident involving unauthorized access to some of your personal data was stored on a third-party application. Importantly, no credit information was accessed.”

However, TransUnion has also said that affected parties will be provided with credit monitoring services, which means that the exposed details may involve more than just customer names but may also include additional details that could put customers at risk of identity theft or, at the very least, phishing attempts.

More from Tom's Guide

• 2.5 Billion Gmail Accounts Could Be Compromised — Google Just Issued A Password Reset Warning
• Over Half a Million Hit in Major Healthcare Data Breach With SSNs, Financial Info and More Exposed — What to Do Now
• Google wants to fight Android malware by making sideloading more difficult — here's how

Hackers and especially ransomware gangs have been on a rampage targeting and attacking healthcare organizations this year. Now, one of the largest dialysis providers in the U.S., DaVita, has fallen victim to a massive healthcare data breach.

As reported by Comparitech, the kidney dialysis company DaVita has revealed that it suffered a data breach earlier this year when hackers gained unauthorized access to servers, primarily located in its laboratories.

While DaVita became aware of this security incident in mid-April, the hackers behind the attack first gained access to its systems on March 24. During which time, they stole all sorts of sensitive personal, financial and medical data.

DaVita hasn’t come out and said which hackers are responsible but after news of the breach was made public, the Interlock ransomware gang took credit for the attack, claiming it managed to steal 1.5TB of data including 683,104 files and 75,836 files according to a previous report from Comparitech.

Whether you, a family member or someone you know gets dialysis treatment at one of DaVita’s centers, here’s everything you need to know about this latest data breach along with some tips on how you can stay safe and what to do now.

Exposed personal and medical info

Now that the dust has settled and DaVita has carried out a full investigation into the security incident, the company has begun sending out data breach notification letters to affected individuals.

According to DaVita’s latest notice (PDF), the following patient data was stolen in the breach:

• Names
• Addresses
• Dates of birth
• Social Security numbers
• Health insurance info
• Medical info (conditions, treatments and test results)
• Tax ID numbers
• Images of checks made out to the company

It’s worth noting that the types of stolen data are different for all impacted individuals. While some people may have had all of the data listed above stolen in the breach, this may not be the case for everyone.

How to stay safe after a data breach and what to do next

If you or someone in your household gets dialysis treatments at DaVita, then chances are you may have received a data breach notification letter in the mail or one is on its way out to you.

Inside this data breach notification letter, you can find out exactly what data on you was exposed as a result of the breach. However, you’re going to want to hold onto this letter as DaVita is providing free access to one of the best identity theft protection services for a set amount of time.

I say this as the sample data breach notification letter (linked above) that I looked at doesn’t say a specific time frame but usually, companies provide access to one of these services for either 12 or 24 months. Don’t worry though, as your own letter will definitely include the exact timeframe.

In this case, DaVita is offering impacted individuals access to Experian IdentityWorks. While we haven’t reviewed this particular identity theft protection service yet, it is considered a reliable and worthwhile service. Inside your data breach notification letter, you’ll find a code which you can use to activate your IdentityWorks subscription. However, you will need to do so by November 28th of this year if you wish to claim this free offer.

If your Social Security number or other stolen data is used to commit fraud or identity theft, IdentityWorks has experts standing by to help you regain any lost funds or to restore your identity. In fact, the plan offered by DaVita includes up to $1 million in identity theft insurance.

Besides signing up for this identity theft protection service, you’re also going to want to keep a close eye on your financial accounts for signs of fraud and if you’re really worried, you can also freeze your credit so that hackers or scammers with your stolen information can’t take out loans in your name.

Likewise, you’re going to want to be extra careful when checking your inbox, text messages and even when answering the phone. The reason being is that your stolen information could be used in targeted phishing attacks.

In addition to DaVita, the Interlock ransomware gang has also gone after other healthcare organizations in previous data breaches including Texas Digestive Specialists, Kettering Health and Naper Grove Vision Care back in May. Given that the pace and scope of the group’s attacks seem to be increasing, I don’t see them slowing down anytime soon.

More from Tom's Guide

• 200,000 passwords, credit card data and more stolen by this dangerous new malware
• Email security features are being hijacked to steal Microsoft 365 logins
• Google just fixed two high-severity Qualcomm bugs used by hackers in their attacks

When a company suffers a major data breach, it can be hard to truly assess the full extent of the damage caused. This is why it will often take months if not years to determine the number of people affected which is exactly what happened with Kelly Benefits.

As reported by BleepingComputer, the benefits administration and payroll provider Kelly & Associates Insurance Group, also known as Kelly Benefits, has revealed that the impact of the security incident it experienced between December 12-17 of last year is much worse than originally thought.

Back in April, the company originally said that 32,234 individuals were affected after hackers gained access to its IT systems and stole sensitive files. However, over the course of the past three months, Kelly Benefits has revised this figure multiple times. Now though, it has revealed that 553,660 individuals are at risk as a result of this breach.

Here’s everything you need to know about this major data breach including some tips and tricks to help you to stay safe from hackers if your personal information was compromised.

Impacted companies and compromised data

Even if you’ve never heard of Kelly Benefits before, chances are that a company you do business with relies on its services which include benefits consulting, enrollment technology, payroll administration, carrier management and more.

In fact, in a public data breach notice recently published on its site, the firm explained that a total of 46 companies are impacted as a result of the breach. Here are some of the most popular and well-known ones but you can check the page linked above for the full list:

• Wawa
• United Healthcare
• Aetna Life Insurance Company (CVS Health)
• Humana Insurance ACE
• CareFirst BlueCross BlueShield
• Mutual of Omaha Insurance Company
• The Guardian Life Insurance Company of America

In addition to that notice, Kelly Benefits also sent out personalized ones (example here) to impacted individuals explaining the specific data types that were compromised. This is because the exposed personal, financial and health info varies per person.

Surprisingly though, as BleepingComputer points out, in its public data breach notice, Kelly Benefits says that the compromised data may include the full names, Social Security numbers, tax ID numbers, dates of birth, medical and health insurance info and financial account info of those caught up in this breach.

With all of that information in hand, the hackers responsible for this data breach could launch targeting phishing attacks, all sorts of different scams or worse, they could try to commit identity theft.

How to stay safe after a data breach

Due to U.S. laws, when a company is hit by a data breach, they have to inform you regarding what type of data was stolen. However, just like when dealing with the IRS, data breach notification letters typically arrive via traditional mail as opposed to in an email, text message or phone call.

If a company you're a customer of does business with Kelly Benefits, then you’re going to want to keep a close eye on your mailbox over the next few days/weeks. The reason being is that your personalized data breach notification letter will let you know exactly what types of your personal, financial or medical data were compromised.

At the same time, Kelly Benefits is offering free access to one of the best identity theft protection services from IDX for affected individuals for a full year. The letter will likely contain an enrollment code that you can use to redeem this offer if you want to take the company up on it. And you should, since identity theft protection services can help you regain your identity after an incident like this one but they can also help you recover any funds lost to fraud as a result of this data breach.

From there, you’re going to want to monitor all of your financial accounts for signs of fraud or abuse. Another step that may be worth taking is to freeze your credit with the three major credit bureaus: Equifax, Experian and TransUnion. This way, cybercriminals with access to this stolen data won’t be able to take out loans in your name.

Even if you try your hardest to avoid falling victim to a data breach, as you see here, you can easily get wrapped up in one as a result of a company you do business with relying on another firm’s services. This is why you need to take action immediately when you learn that your personal or financial information was exposed as the result of a data breach.

Now that cyberattacks and data breaches becoming a much more common occurrence though, you should always carefully monitor your personal and financial accounts for anything amiss since early detection can save you a whole lot of hassle later on.

More from Tom's Guide

• Major security flaw exposes Sony, JBL and Bose headphones to hijacking threat — how to stay safe
• 61 million Verizon records reportedly for sale online — including date of birth, tax ID and phone numbers
• FBI warns scammers are posing as fraud investigators to steal sensitive healthcare info

Picture this: You're at home when the phone rings, and an automated voice on the other end tells you that you're being offered a great deal on your internet bill which includes 50% off and a free Apple watch if you act now.

All you have to do is purchase a gift card and call in with the numbers on the back to secure your discount.

If big flashing red lights didn’t just go off behind your eyes with a “whoop whoop” alert noise, then let me clue you in: No. Nope. Never. Hang up now.

What you've just experienced in one of the newest and most common scams that fraudsters use to trick people out of their money and often their personal information: a gift card scam.

A recent FTC alert says that currently, scammers have been impersonating major service providers like AT&T, Comcast Xfinity and Spectrum using automated robocalls in order to push fake limited time offers in order to trick people into paying them in gift cards.

The fake robocalls will offer fake discounts like a 40-50% off of a service bill, or a special bundle deal or free gift (like an Apple Watch), and usually pressure a victim by adding a sense of urgency or putting a time limit on the offer by saying the discount is only available today or for the next few hours.

“To secure the discount” you are told to pay upfront using a gift card from retailers like Apple, Google Play or Target, then asked to share the gift card number and PIN over the phone. Sometimes they’ll also ask for your service account information to verify your telecom account or login credentials. Then they'll take the gift card money and sometimes cancel or take over your account as well.

What to know about gift card scams

If you're not familiar with gift card scams, don’t feel bad – they’re popular because they work. And they work because they count on people wanting to secure something that is being offered to them urgently (like a discount on phone or tv or internet service) or with a time limit.

They work for scammers because gift cards are not traceable or refundable like credit cards so it’s easier for them to get away with this trick.

And they’re all over the place. Here's what you should know:

Gift cards are meant to be, well, gifts. So if anyone ever requests a gift card as payment, it should immediately make you wary and suspicious.

If they are ever demanding or urgent, hang up, cancel the chat or otherwise remove yourself from the conversation.

If you don’t know someone or have never met them, don’t provide a gift card as payment.

I cannot think of a single legitimate company that accepts gift cards as payment, but I can think of dozens of circumstances wherein gift card payments are used in fraud, tricks and scams.

And the same thing applies to login information – your account provider should never ask you to give those details over the phone, so please don't give those details out freely unless you've double and triple checked who you're speaking to.

That being said, these scams prey on a sense of urgency so don’t feel bad if you’ve already given out the goods. Here’s what to do next.

What to do if you've fallen for a gift card scam

First things first: Report the scam to the FTC at Reportfraud.ftc.gov and fill out the online forms. This can track the scam and help protect other consumers. Keep copies of what you've filed with the FTC and all other companies you contact.

Next, contact the company that issued the gift card and explain the situation. Make sure to provide them with the relevant details like the gift card number, purchase receipt and any other information you have. You can ask for you money back as well – though, you may or may not have any luck with that, depending on whether or not the scammer has taken the funds off the card, but it doesn't hurt to ask.

You can also report the fraud to the FBI's IC3 (Internet Crime Complaint Center) at IC3.gov. And if you used a payment app such as Venmo, PayPal or Zelle, you can attempt to dispute the payment or transaction with them too.

If you suspect, or know, that your personal information was compromised you can create an identity theft report at Identitytheft.gov and get a personal recovery plan created there as well. You should also look into signing up for one of the best dentity theft protection services while you're at it, because your data is now exposed to hackers and threat actors who can use it for a variety of malicious purposes.

This is also a good time to go ahead and change all of your account passwords, especially if you gave out any login or personal information. If you're not using one of the best password managers, look into signing up for one of those too – it can make it a lot easier to not only keep track of your accounts and passwords but to keep them protected as well.

Lastly, depending on the circumstances, you may consider also filing a police report.

More from Tom's Guide

• Help Tom's Guide - your chance to win a $250 Amazon gift card
• Your password can get cracked almost instantly — here's how to make a stronger one
• Subscription scams surge across hundreds of fake websites — how to stay safe

Even if you use strong, complex passwords and know how to spot the signs of a phishing attack, your personal, financial and even health data can still end up in the hands of hackers as the result of a data breach.

To make matters worse, the company that got hacked might not even be one you personally do business with like what just happened with Texas-based Landmark Admin. As reported by BleepingComputer, the third-party administrator (TPA) for life insurance and annuity companies has revealed that the fallout from the data breach it suffered last year is actually worse than we previously thought.

Back in October, I covered this data breach which occurred in May of 2024 and at that time, it was believed that 800,000 people were impacted by it. Now though, in an updated filing with the Maine Attorney General’s Office, Landmark Admin says that the number of affected individuals is almost double that.

Here’s everything you need to know about this data breach, what to do if you’re impacted and some tips and tricks on how you can stay safe following a major security incident like this one.

Personal, financial and health data exposed

Back in May of last year, Landmark Admin detected suspicious activity on its network. The company then shut down its IT systems and disabled remote access to prevent this cyberattack from spreading further.

From there, Landmark Admin worked with a third-party cybersecurity firm to investigate this incident to determine if any data was stolen during the attack. As it turns out, the hackers behind the attack accessed all sorts of personal, financial and health data, including:

• Full names
• Home addresses
• Social Security numbers
• Tax identification numbers
• Driver's license numbers
• State-issued identification cards
• Passport numbers
• Financial account numbers
• Medical information
• Dates of birth
• Health insurance policy numbers
• Life and annuity policy information

It’s worth noting though that the types of data that were exposed vary for each impacted individual. So while one person might have had their personal information exposed, another may have had their medical information exposed.

Last year Landmark Admin believed that approximately 806,519 people had their data exposed as a result of this breach. Now though, the company has revealed that the number of affected individuals is actually much higher and is closer to 1,613,773 people. Since Landmark Admin’s forensic investigation is still ongoing, the final number of impacted individuals could be even higher.

How to stay safe after a data breach

Landmark Admin is planning to notify all of the people whose data was caught up in this breach by mail and this is typically how companies inform affected individuals that a breach has taken place. Once they receive this data breach notification, they will then have 90 days to ask any questions or raise concerns through a dedicated helpline.

To soften the blow while keeping impacted individuals safe from scams and other cyberattacks using their stolen data, Landmark Admin is offering free access to one of the best identity theft protection services for an entire year. This will be through the identity theft provider CyberScan and in addition to identity and credit monitoring, affected individuals will also be eligible for up to $1 million in identity theft insurance if they happen to fall victim to identity theft as a result of this breach.

If you’re worried that your personal, financial or medical data may have been exposed in this data breach, you can call the helpline at 1-844-428-5109 to find out more. Likewise, if your insurance provider works with Landmark Admin, you’re going to want to keep a close eye on your mailbox as the data breach notification sent out by the company will provide you with the necessary steps and potentially a code to sign up for CyberScan’s identity theft protection.

For those who are impacted by this breach, you’re going to want to be extra careful when checking your inbox, messages, social media accounts and even when answering your phone going forward. The reason for this is that hackers often launch targeted phishing attacks using the sensitive data stolen in a breach like this one. With all of this info in hand, they can easily craft phishing emails that appear legitimate or impersonate someone important over the phone.

Besides taking Landmark Admin up on its offer for identity theft protection, you’re also going to want to carefully check in on your financial accounts for signs of fraud. At the same time, you might also want to consider freezing your credit or locking your Social Security number since scammers may try to take out loans in your name.

Dealing with a data breach is never easy but by taking the right actions early, you can avoid becoming a victim to identity theft which can often take months or even years to recover from. I’ll be keeping a close eye on this breach myself and will update this story if and when I learn more.

More from Tom's Guide

• Watch out — this official-looking Google email is actually from scammers and can take over your account
• 12 computer security mistakes you're probably making — and what to do instead
• The best antivirus software — tested and rated

Even if you practice perfect cyber hygiene, you can still wake up to find yourself amid a major security crisis resulting from a data breach, and that’s exactly what happened to half a million teachers.

As reported by The Record, over 500,000 teachers and other employees who work in education across Pennsylvania’s public schools had their sensitive personal and financial data stolen by hackers. This happened after the Pennsylvania State Education Association (PSEA) fell victim to a security incident last summer.

In a data breach notice on its site, PSEA explains that the attack occurred on July 6, 2024. Following the incident, the teachers union informed law enforcement and investigated the matter.

The union worked closely with external cybersecurity professionals. The review of this investigation was then completed in February, revealing that the attackers managed to steal all sorts of data.

In a post on X from September of last year, it was revealed that the Rhysida ransomware gang claimed responsibility for the attack and said they would publish all of this stolen data.

Fortunately, it doesn’t seem like the group followed through with this claim, but all of this personal and financial information could end up sold on the dark web for other hackers to use in their attacks.

Here’s everything you need to know about this new data breach and the steps affected individuals should take immediately to stay safe.

Personal and financial data exposed

In its notice, PSEA lists all of the stolen data, which includes the full names of those impacted along with one or more of the following items:

• Date of Birth
• Driver’s License or State ID
• Social Security Number
• Account Number
• Account PIN
• Security Code
• Password
• Routing Number
• Payment Card Number
• Payment Card PIN
• Payment Card Expiration Date
• Passport Number
• Taxpayer ID Number
• Username
• Password
• Health Insurance Information
• Medical Information

As you can see from the list above, a hacker could exploit this stolen data for all sorts of nefarious purposes. From launching phishing attacks to taking over accounts to committing fraud or even identity theft, the fallout from this breach for impacted individuals could be massive.

How to stay safe and what to do now

If you’re a PSEA member, chances are this data breach will likely impact you. Fortunately, the organization is taking steps to rectify this situation by providing free access to one of the best identity theft protection services for 12 months through IDX.

You can find all of the necessary enrollment info at the bottom of PSEA’s data breach notification page, but to save you some time, you can sign up online at https://app.idx.us/account-creation/protect or call IDX directly at 1-877-720-5373.

Even though I was not personally affected, I did call the number for more info and had to verify my name and address to see if the breach impacted me.

In addition to visiting the website above or calling the phone number, impacted individuals will likely receive a data breach notification letter in the mail. It should have even more information, including a code to gain access to IDX’s credit and identity monitoring. However, it’s worth noting that those affected by this breach have until June 17 to enroll.

Besides taking advantage of this offer, there are also some steps you can personally take to avoid falling victim to any attacks resulting from this breach. You’ll want to be very careful online going forward.

Be on the lookout for suspicious emails, text messages and phone calls, and if any of these contain links, avoid clicking on them as they could lead to malicious sites.

The same goes for any attachments, as downloading them could infect your devices with malware. Likewise, you should also be using the best antivirus software on your Windows PC, the best Mac antivirus software on your Apple computer or one of the best Android antivirus apps on your smartphone to help keep you safe in case you accidentally download anything dangerous.

As I have family members who are teachers in Pennsylvania, I’ll be keeping a close eye on this data breach. I will update this story if I learn anything else about the attack that led to it.

More from Tom's Guide

• Malicious Android apps with 60 million installs bombarding phones with ads and phishing attacks
• TikTok has rolled out a vital new security feature — here's how to use it
• FBI issues warning to millions of Americans to avoid these websites that can steal your passwords and banking info

Back in June of 2024, the insurance company Globe Life suffered a data breach that allegedly accessed policyholder data. The company initiated an investigation that revealed some information back in October of last year which claimed that at least 5,000 people were potentially affected.

However, its has since finished its investigation, and the number of impacted customers is significantly higher. As reported by BleepingComputer, Globe Life is now saying that an additional 850,000 people may be affected by the June breach.

"Immediately upon notification of these circumstances, the Company removed external access to the portal," Associate Counsel and Corporate Secretary at Globe Life Christopher Moore wrote in a filing with the U.S. Securities and Exchange Commission (SEC) in June.

The October release revealed that a small-scale breach was discovered in a subsidiary company, American Income Life Insurance Company. At the time, it was reported that at least 5,000 customers of that subsidiary were affected. Though it was noted then that the number might grow.

In a new filing with the SEC, a still unknown threat actor was able to access customer information in "specific databases maintained by a small number of independent agency owners." The filing says that Globe Life could not confirm if more information was stolen than the initial 5,000 people already affected, but that it is exercising caution and providing credit monitoring services to every potentially impacted policyholder whose information was stored in those databases.

The threat actor may have been able to access a wide spread of sensitive information including:

• Full names
• Email addresses
• Phone numbers
• Postal Addresses
• Dates of Birth
• Social Security Numbers
• Health data
• Insurance policy information

According to the filing, the unknown attacker attempted to extort Globe Life, but the company declined to pay the ransom. The company asserts that the breach did not involve data encryption or its IT systems.

How to stay safe after a data breach

Globe Life is offering credit monitoring services but if their offering isn't up to par, you might also want to consider signing up for one of the best identity theft protection services to keep a closer eye on your personal data and digital life. It was not stated how long that offer would last.

If you're a customer of Globe Life or one of its subsidiary agencies, you will want to pay attention to your inbox and accounts going forward. Sensitive information can be sold to bad actors who create convincing phishing emails to try and gain access to your other accounts or they might even create profiles using your personal information elsewhere.

Basically, be cautious with any communications — email, text, social media — for the time being. Also keep a close eye out for links or attachments that you didn't request and whatever you do, don't click on the links or download any attachments sent from unknown senders to your devices.

Outside of identity protection you'll also want to make sure you have the best antivirus software installed on your PC, the best Mac antivirus software installed on your Apple computer and one of the best Android antivirus apps on your phone if you don’t use an iPhone. Potential phishing emails and messages could contain malware as well as other threats and a good antivirus will help keep you safe.

In the meantime, Globe Life seems to believe that the hack will not affect its operations, but you'll also want to change any passwords you have associated with accounts via the insurance giant.

More from Tom's Guide

• Billions of Chrome users at risk from new browser-hijacking Syncjacking attack
• Thousands of WordPress sites hijacked to spread Windows and Mac malware
• Is DeepSeek a national security threat? I asked ChatGPT, Gemini, Perplexity and DeepSeek itself

More and more details have emerged about the December 28, 2024 cyberattack of the cloud-based educational software solutions company PowerSchool. While the company had disclosed the attack on January 7th, recently the threat actor who breached the company has claimed in the extortion demand that the number of affected students and employees is over 70 million.

As reported by BleepingComputer, the personal data of 62.4 million students and 9.5 million teachers was exposed during the attack when the threat actor used stolen credentials to access the PowerSchool customer support portal. After which, they used a maintenance access tool to download the data from districts’ PowerSIS databases.

PowerSchool reportedly paid a ransom to stop the data from leaking, and the hacker claimed they deleted all of the stolen data. This data ranges per district as the types of info each district stores in the SIS database will vary depending on the policy requirements of their state and district requirements. However, it is expected that less than a quarter of the students who were impacted by the breach had their Social Security numbers exposed. A further review of the data is required though, as both cloud-based and on-premises SIS databases must be examined and that requires districts to share information for analysis.

PowerSchool, which is a cloud-based software for K-12 schools, provides tools that handle enrollment, communication, attendance, learning systems, staff management, grades, finances, analytics and more. The company has offered two years of free identity theft protection and credit monitoring services for all the students and district employees who were affected by the breach. They will also send data breach notifications to the State Attorney General’s offices of each affected school district on behalf of customers, though a timeline as to when that will happen is unclear.

The company has also promised to release an incident report based on CrowdStrike's investigations from January 17th but that has also not yet been made available; PowerSchool says that CrowdStrike is still working on finalizing a forensic report that can be made available to customers. In the meantime, there is a dedicated public website that those impacted can monitor for additional information and an update on the customer-only FAQ states that customers can receive a confidential CrowdStrike fact sheet on what is currently known.

What to do now

First, if you've received an email or notice from your school district, it should have some information about whether or not your data was affected and how to proceed. If you have been affected, follow the steps and details in the note about signing up for the identity theft protection and credit monitoring services offered by PowerSchool.

If you have questions, there should be details about how to contact your district in the email or notice or you can visit PowerSchool's SIS incident page here. If you want to make sure you and your family are already protected, you can check out our list of best identity theft protection services, which we tested using our own accounts – and includes a Best for families option.

More from Tom's Guide

• 5 worst data breaches of 2024 — including the mother of all breaches
• Critical macOS flaw puts your data and cameras at risk — update right now
• Google Password Manager could soon be getting this highly requested feature

The more sensitive information on hand the better for hackers which is why the news that the U.S. law firm Wolf Haldenstein has been hit by a major data breach isn’t all that surprising.

As reported by BleepingComputer, the breach itself occurred back in December, though we’re just learning about it now. In fact, we reported on five separate data breaches that month including a massive healthcare breach that affected 6 million people as well as one at a background check company.

Unlike with your typical data breach where hackers go after large retailers or other consumer companies, this string of attacks targeted organizations storing much more sensitive info like healthcare data and Social Security numbers (SSNs). Infiltrating and breaching a law firm’s systems makes perfect sense too though, as the hackers responsible could use this stolen information for blackmail as well as in targeted phishing attacks.

With offices across the U.S. in New York, Chicago and other big cities, Wolf Haldenstein has revealed that the sensitive data of nearly 3.5 million individuals has been exposed as a result of this new breach. Here’s everything you need to know about this latest data breach along with some steps you can take to stay safe after a company you directly or even indirectly do business with suffers a similar fate.

Exposed but not yet misused

According to a data breach notification put out by Wolf Haldenstein, the law firm explained that it detected suspicious activity on its network in mid December of last year. From there, it took steps to secure its network and hired a cybersecurity firm to investigate the incident further.

Following this investigation, Wolf Haldenstein learned that an unauthorized threat actor accessed certain files and data stored within its network during this time frame. As of now, the law firm hasn’t seen any evidence that this stolen data is being misused online. However, while on its systems the threat actor or hackers behind the breach managed to obtain the following data on impacted individuals:

• Full names
• Dates of birth
• Social Security numbers (SSN)
• Addresses for the past two to five years
• Proof of current address (like a current utility bill)
• Photocopies of government issued IDs or driver’s licenses
• Copies of police reports, investigative reports or complaints to law enforcement

With all of this data in hand, the threat actor responsible for this breach could launch targeted phishing attacks against impacted individuals or use it for social engineering and other scams. Likewise, they might sell it to other hackers on the dark web to use in their own attacks.

Unfortunately for affected individuals, Wolf Haldenstein has run into difficulties determining who is actually impacted by this breach. This will make it harder to send out data breach notification letters to anyone caught up in the fallout.

How to stay safe after a data breach

Normally after a major breach like this, a company will offer free access to the best identity theft protection services, though some don’t. Wolf Haldenstein is taking the middle ground by providing impacted individuals with free credit monitoring but not identity theft protection. However, that could change.

In its data breach notification post, the law firm provides a phone number at the bottom that those who are concerned that their sensitive information may have been stolen can call for more details on how to set up this complimentary credit monitoring.

It’s also worth noting that at this time, we don’t know whether the exposed data belonged to clients, employees or other individuals connected to the firm. Regardless, if you think your data might have been compromised in this breach, you’re going to want to pay careful attention when checking your inbox going forward as all of that stolen info could easily be used to craft convincing phishing emails. At the same time, as addresses were exposed, you could also end up with suspicious letters in your actual mailbox.

Basically, you want to be very cautious with dealing with any communications — whether it be over email, text or social networks — for the time being. Don’t open any links, download attachments or even respond to any email or message that looks suspicious.

If you haven’t already, now would be a great time to invest in identity theft protection. You probably also want to make sure that you have the best antivirus software installed on your PC, the best Mac antivirus software installed on your Apple computer and one of the best Android antivirus apps on your phone if you don’t use an iPhone. All of these phishing emails and messages could contain malware and a good antivirus will help you stay protected from additional attacks.

We’ll update this story with more details on the affected individuals once we know more but until then, make sure you're practicing good cyber hygiene and being extra careful online and in the real world if you think you may be impacted by this breach.

More from Tom's Guide

• Critical macOS flaw puts your data and cameras at risk — update right now
• iMessage under attack from scammers sending phishing messages
• 45 million Americans allegedly had their location data collected and sold by this top insurance firm

Getting in to see your doctor in person can be difficult, especially when you’re busy. This is why many Americans have turned to telehealth instead. However, one such service has reported that it fell victim to a data breach in which the personal and medical info of more than 900,000 patients was exposed online.

As reported by BleepingComputer, the service in question is ConnectOnCall, and it’s a subsidiary of the healthcare software as a service company Phreesia. In addition to telehealth, ConnectOnCall provides after-hours on-call answering services for doctor’s offices, hospitals and other healthcare businesses.

Now, though, ConnectOnCall has revealed that between February and May of this year, a third party had access to its service, app data, and some provider-patient communications.

Here’s everything you need to know about this latest medical data breach — the third one I’ve covered this month — along with some tips and tricks on what steps you can take to stay safe from hackers following a security incident like this one.

What data was exposed

In a press release detailing what occurred, ConnectOne explains that after discovering a breach had taken place, it immediately began an internal investigation and sought the help of external cybersecurity specialists to “determine the full nature and scope of the incident.”

As for how many Americans are caught up in this data breach, the company told the U.S. Department of Health and Human Services that approximately 914,138 patients were affected. The personal information exposed during the almost three-month period in which its systems were accessed includes medical record numbers, dates of birth and info related to health conditions, treatments or prescriptions.

Unfortunately though, in a small number of cases, affected individuals also had their Social Security numbers accessed by this unauthorized third party. At this time, we still don’t know if a single individual or a group of hackers was behind the breach itself.

As for ConnectOnCall’s parent company Phreesia, it assured customers that its services, as well as its patient intake platform, were not affected by this attack.

How to stay safe after a data breach

Although I haven’t been able to track down the data breach notification letter from ConnectOnCall yet, it’s already going out to impacted individuals. This means if you use its telehealth services or even if your doctor uses its after-hours on-call answering service, you could soon be getting a letter in the mail.

Just like with the IRS, data breach notifications are sent out via the mail as opposed to email, so if you think you might be affected, you’re going to want to keep a close eye on your mailbox over the coming days/weeks.

Generally, after a significant breach, businesses provide all impacted customers with free access to the best identity theft services. In this case, though, ConnectOnCall is just providing identity and credit monitoring services through Kroll for the limited number of people whose Social Security numbers were exposed in this security incident.

If that includes you and you do get this letter, I’d recommend signing up for this service immediately. While we haven’t reviewed Kroll yet, it currently has an A- rating with the Better Business Bureau and has been in business for 29 years. Recovering from identity theft on your own can take years as well as be very costly, so this is an offer you’re not going to want to miss.

For those who don’t get this offer, it still might be worth signing up for identity theft protection as all of your other personal and medical info could be used by hackers in their attacks. For instance, you’re going to want to be extra careful when checking your inbox, as hackers often use info like this in targeted phishing attacks. Likewise, you will want to check your bank and other financial statements for irregularities, as they could be signs of fraud.

Medical data breaches seem to be all the rage with hackers now, and for good reason. These companies store all sorts of sensitive data and have the money necessary to pay a ransom to stop hackers from leaking their stolen info.

There’s not much you can do in a data breach like this one since it wasn’t your computer that got hacked. Still, though, by practicing good cyber hygiene and signing up for any services offered to you, you can avoid having your identity stolen after a data breach.

More from Tom's Guide

• Hackers are posing as job recruiters to spread a dangerous banking trojan and steal your money
• 100 million Americans just had their background check data exposed
• Massive parking app data breach — how to see if you qualify for part of $32.8 million settlement

Having your personal or financial information stolen by hackers is bad enough as it is, but we’re now seeing an uptick in healthcare data breaches. In addition to all these details, cybercriminals are also getting their hands on medical records, lab results, and more.

Just the other day, I covered a data breach at a health IT company in which thousands of children had their health information exposed. Now, a Maryland-based clinic has revealed that it suffered a similar breach back in October of this year.

As reported by Cybernews, the Center for Vein Restoration (CVR) with 110 locations across the U.S. fell victim to a data security incident that exposed the protected health information (PHI) of patients as well as the personal information of both current and former employees. While vein restoration is a more specialized medical procedure, approximately 445,000 people’s data has now been exposed online.

Here’s everything you need to know about this latest data breach including what to do next if you’re a patient of the Center for Vein Restoration along with some tips and tricks to help you stay safe from hackers after a major security incident like this one.

Stolen medical data

According to a data breach notice (PDF) on the Center for Vein Restoration’s website, on October 6, unusual activity was detected on its systems. After securing its systems and notifying law enforcement about the breach, the center initiated an internal investigation and then hired a third-party forensic firm for additional assistance.

The investigation revealed that while the unauthorized attackers were in CVR’s IT environment, they may have accessed files that included patient names along with some or all of the information listed below:

• Addresses
• Dates of birth
• Social Security numbers
• Driver’s license numbers
• Medical record numbers
• Diagnosis’
• Lab results
• Medications
• Treatment information
• Health insurance information
• Provider names
• Dates of treatment
• Financial information

As for past and current employees, information related to their employment may have been obtained by the hackers responsible for this data breach.

With all of this information in hand, hackers can launch a range of different attacks and scams against individuals impacted by this breach from targeted phishing attacks using this stolen info as a lure to identity theft. However, since they also obtained medical record numbers, lab results, details on treatments, and health insurance info, the hackers behind this breach could also commit medical identity theft wherein they submit forged claims to a person’s insurance provider or even to Medicare.

What to do next after a data breach

If you or someone you know has received treatment from the Center for Vein Restoration, you’ll very likely be receiving a data breach notification in the mail. Besides letting you know that a security incident occurred, these notices can also provide useful info on the steps you should take next and what the company involved in a data breach is doing to keep its customers (or patients) safe.

While some companies deny that a breach even took place or fail to provide victims with some form of protection afterward, the Center for Vein Restoration is taking this matter very seriously. Oftentimes with other data breaches, we learn details about what actually happened through a filing with a state’s Office of the Attorney General (usually Maine). In this case, CVR has a section right on its home page which is where I found the Notice of Data Security Incident linked above.

CVR is providing affected individuals with access to one of the best identity theft protection services through TransUnion. However, the notice on its site doesn’t explain the duration of these services but typically, companies provide either a one-year or two-year subscription. The duration will most likely be included in the official data breach notification letter you’ll receive in the mail if you’re impacted by this breach.

Just like with other data breaches, you’re going to want to carefully review all of your financial and health statements for irregularities which could point to fraud or identity theft. The same goes for your credit reports too though. It could also be worth placing a fraud alert or a security freeze on your credit so that hackers can’t take out new credit cards or loans in your name.

We could potentially learn more details at a later date but for now, CVR has taken all of the necessary steps on its end by informing patients and providing them with identity theft protection. However, you will need to sign up for this service and remain vigilant when it comes to checking all of your accounts for suspicious activity at least for the time being.

More from Tom's Guide

• Android phones under attack from malicious apps with over 8 million installs — delete these now
• New rule would make it much harder for data brokers to sell your personal info
• Hackers are posing as job recruiters to spread a dangerous banking trojan and steal your money

No matter how careful you are online, your sensitive personal and financial data could end up in the hands of hackers if a company you do business with directly (or indirectly) ends up falling victim to a data breach.

As reported by CyberNews, the debt relief firm Set Forth recently suffered a data breach in which hackers were able to gain access to internal documents stored on the company’s systems. The company itself provides administrative services to Americans enrolled in debt relief programs but it also works with business-to-business partners such as Centrex.

Following this cyberattack, data breach notifications are now being sent out to affected customers. Here’s everything you need to know about the types of data accessed in this attack and what you can do next if your information was exposed online as a result.

Unauthorized access to sensitive documents

In a data breach notification sent to the Maine Attorney General’s office, Set Forth revealed that 1.5 million Americans are impacted by this breach.

The attack itself occurred back in May of this year, at which time the company implemented incident response protocols before working alongside independent computer forensic specialists as part of its investigation into the incident.

According to Set Forth, the full names, Social Security numbers (SSNs) and dates of birth of impacted individuals may have been obtained by the hackers behind this attack after they gained access to documents stored on the company’s systems. To make matters worse, personal information belonging to “a spouse, co-applicant or dependent” may have also been accessed during the attack.

At the moment, there are no indications that this information has been used by hackers in their attacks. Still though, all of this personal data could end up for sale on the dark web or it might even be used in targeted phishing attacks going forward.

Fortunately, Set Forth is providing free access to one of the best identity theft protection services through Cyberscout for a year for those affected by this latest data breach. While we haven’t reviewed this particular service, it’s been in business for just over 20 years with 1.5 million commercial policies and it has handled more than 1 million breach responses.

How to stay safe after a data breach

After a data breach like this one, you’re going to want to pay close attention to your mailbox. This is because data breach notification letters like the sample one linked above are typically delivered via traditional mail as opposed to through email.

If your personal and financial data was exposed, this letter will provide you with a code to sign up for Cyberscout’s identity theft protection which is worth doing as it’s free and they have experts standing by to help you with any questions you may have.

Once this is done, you’re going to want to carefully monitor all of your financial accounts for signs of fraud. With your SSN in hand, hackers can sign up for loans in your name, apply for jobs and even commit crimes which you will be held accountable for. This is one of the reasons identity theft is so scary and difficult to recover from.

Likewise, you also want to pay close attention when checking your inbox, messages and social media since hackers can use this stolen information or even the data breach by itself as a lure to get you to hand over more info or even your financial details. Keep a close eye out for emails from unknown senders and ones with blank subject lines. If something looks suspicious or tries to instill a sense of urgency, don’t respond or click on any links or download any attachments that the email might contain. Instead, just delete it.

We might possibly learn more about how this data breach unfolded at a later date but for now, at least Set Forth is providing free identity theft protection for a year as many companies hit by similar attacks often don’t.

More from Tom's Guide

• Scammers prey on Black Friday buyers – don't fall for fake online shops
• These are the best antivirus software solutions to keep you safe from malware
• This nasty Android trojan is hijacking calls to your bank and sending them to hackers

The creators behind one of the best VPNs, NordVPN, have launched its new identity theft protection service, NordProtect. The tool is currently available to NordVPN Prime users in the US, with NordProtect expected to be launched in more markets and as a standalone product in the first half of 2025.

Identity theft is a global problem, and its frequency is on the rise. VPNs are a fantastic way of protecting your privacy online, but they are not a silver bullet and one careless click can leave cybercriminals with all your personal information. NordProtect aims to combat this by recovering and restoring lost identity assets. With user-friendly security features, NordProtect is an all-round service to shield consumer identity.

What does NordProtect offer?

Firstly, NordProtect offers identity recovery and restoration. Victims of identity theft can be reimbursed up to $1 million for expenses incurred in restoring their identity, such as legal costs or lost wages. Users are also connected to an identity restoration case manager to help them recover from identity theft. This is nothing new – NordVPN has included Cyber Insurance for a while now, but it appears it's now moving under the NordProtect banner.

NordProtect also offers cyber extortion protection. $100,000 is available to cover expert assistance and payments, in response to cyber threats to delete or release victims' information or restrict access to their data or smart devices. Again, this has been available for a few months.

Finally, 24/7 dark web monitoring is included in the service. This monitors the dark web and alerts you if your credentials, phone number, social security number, or other identity assets have been leaked. Users can also keep their credit in check with secure credit monitoring. You will receive a monthly individual credit score and will be notified about any suspicious credit activity.

NordProtect is the latest addition to the family of Nord Security brands. They include NordVPN; a password manager, NordPass; encrypted cloud storage, NordLocker; and NordLayer, one of the best business VPNs.

Is this protection available anywhere else?

Many of the best identity protection services need to be purchased separately to a VPN, but do often come with more features and benefits than those included in VPN services. Other than Nord, only one of our best VPN services includes a form of identity protection in its plans.

Our previous number one VPN pick, ExpressVPN, has recently launched its own identity and protection feature, known as Identity Defender. The tool includes ID Alerts, ID Theft Insurance, and Data Removal. Identity Defender is included in ExpressVPN's two-year plan – actually making ExpressVPN a bit of a bargain comparatively. But, like NordProtect, it's currently only available in the US.

ExpressVPN, one of the best VPN services, has launched Identity Defender, a suite of identity alert and protection features. Identity Defender comprises three products: ID Alerts, ID Theft Insurance, and Data Removal. The launch of Identity Defender adds a number of features to ExpressVPN, which addresses one of our key issues with the product – and some are remarkably similar to what some rivals offer.

ID Alerts are personal information monitoring tools, which look out for a change of address, personal information appearing on the dark web, and online appearances of your Social Security number. ID Theft Insurance provides coverage of up to $1 million for identity theft and includes assistance with restoring stolen accounts. Data Removal scans for, and requests removal of, any personal information collected by data brokers.

"With Identity Defender, we aim to provide users with a one-stop solution that not only helps them quickly determine if their information is at risk but also guides them through effective steps to address any issues," says Lauren Hendry Parsons, Digital Privacy Advocate at ExpressVPN.

Who is this available for?

At this stage, the new features are limited to new users in the US only, before progressively rolling out to all US-based users. Android and iOS are the only platforms supporting the new features currently, but ExpressVPN says more will be available soon.

All three features are included free of charge in the 2-year plan. However, for other plans, ID Theft and Data Removal are optional add-ons. Our table details the Identity Defender pricing structure.

A strong response?

ExpressVPN was once our top VPN recommendation, but in our recent ExpressVPN review we were been critical of it falling behind its competitors when it comes to its all-round package. The fact of the matter is that rivals like NordVPN and Surfshark offer more for less. However, this launch shows ExpressVPN isn't resting on its laurels and is taking the fight to its market rivals – and this is a step in the right direction.

"Our mission at ExpressVPN is to provide our customers with the highest level of digital protection possible," says Aaron Engel, Chief Information Security Officer at Express VPN. "Integrating identity protection solutions into our existing offerings was a natural progression for us." There are a number of services offering identity theft protection, including some VPN providers, so this is a welcomed response from ExpressVPN.

The additions from ExpressVPN bring its service closer to its market rivals' higher-tier subscriptions. Threat Protection Pro is included in NordVPN's upper tier subscriptions, and its Prime plan includes cyber insurance. This offers up to $1 million in identity theft recovery, and $100k in cyber extortion protection. NordVPN's Prime plan is currently available for $7.89 per month for 2 years plus three months free. This makes ExpressVPN's 2-year package at $5.32 per month, with an additional three months and identity defender features included, an excellent price.

Surfshark, the best cheap VPN, includes the data removal service Incogni as part of their plans. Incogni scans the internet for your personal data and submits removal requests to data brokers. They keep monitoring for your information and re-submit requests when they are required.

Staying safe from hackers is hard enough as it is but even if you take all the necessary precautions, your personal data could still end up being exposed online as the result of a data breach and that’s exactly what just happened to more than 800,000 people.

As reported by BleepingComputer, the insurance administrative services company Landmark Admin has revealed that it suffered a data breach following a cyberattack that occurred back in May of this year. While you likely haven’t heard of this company before, there’s a chance it could have access to your sensitive personal information.

Landmark Admin is a third-party administrator for a number of insurance companies and it provides back-office services for them such as new business processing and claims administration. In fact, some of the insurance companies it works with include American Monumental Life Insurance Company, Pellerin Life Insurance Company, American Benefit Life Insurance Company, Liberty Bankers Life Insurance Company, Continental Mutual Insurance Company and the Capitol Life Insurance Company.

If any of the companies listed above happen to be your insurance company, then there’s a chance you may receive a data breach notification letter in the mail, if you haven’t already. Here’s everything you need to know about this latest data breach and what steps you should take next if your personal data was exposed online.

From cyberattack to data breach

The reason we know about this data breach in the first place is due to the fact that Landmark Admin had to submit extensive details on what happened in a filing with the Maine Attorney General’s office. In fact, similar filings from other companies are one of the ways in which we often learn more about data breaches.

In this particular filing, Landmark Admin explained that it first detected suspicious activity on its network back on May 13. To prevent this cyberattack from spreading further, the company shut down its IT systems and disabled remote access to its network.

From there, Landmark Admin worked with a third-party cybersecurity firm to investigate this incident and see whether or not any data was stolen during the attack. As it turns out, the company and the cybersecurity firm found evidence that the hackers behind the attack accessed files on the network that contained the sensitive personal information of approximately 806,519 people.

In the data breach notification sent out to affected individuals, Landmark Admin explained that the following information may have been accessed by hackers:

• First name/initial and last name
• Date of birth
• Addresses
• Social Security numbers
• Tax identification numbers
• Driver’s license numbers
• Passport numbers
• Health insurance policy number
• Medical information

It’s worth noting though that the amount of exposed information “varies for each potentially impacted individual” according to Landmark Admin. This means that while one victim might have had their name and address exposed, another could have had their SSN and medical information exposed.

How to stay safe after a data breach

So what should you do if your insurance company used Landmark Admin’s services and your personal data was exposed as a result of this breach? For starters, you should check your mailbox to see if you received a data breach notification letter in the mail.

In case you’re wondering what this kind of notice would look like, there’s a sample copy included as a PDF in Landmark Admin’s filing with the Maine Attorney General’s office linked further up in this story. This letter has even more details on the incident and what the company did in its aftermath to protect its systems and the customer data stored on them.

While some companies fail to offer additional protection to affected customers or impacted individuals in this case, Landmark Admin is providing 12 months of free access to one of the best identity theft protection services through IDX. While we haven’t reviewed this particular service yet, IDX has been in business for 20 years, serves over 40 million customers and is used by Fortune 500 companies as well as the U.S. federal government.

If your identity happens to be stolen as a result of this data breach, IDX provides up to $1 million in identity theft insurance. These funds can be used to help get new documents, recover any lost wages or other damages and to hire legal counsel if necessary. Affected individuals will have access to credit monitoring services for a year as well.

For those who may be overly worried – and rightfully so after a data breach like this one — there are a number of different online data leak checkers you can use to see if your personal and financial information has ended up on the dark web. While Troy Hunt’s Have I Been Pwned is one of the oldest and most widely known, Surfshark recently launched its own data leak checker. However, as the number of data breaches has shot up in recent years, it’s likely you might find out that your data was exposed in a different incident. This is why the letter from Landmark Admin is the best way to know if your personal information was part of this particular data breach.

From here, you’re going to want to monitor all of your online accounts to look for anything unusual or suspicious. If the hackers behind this breach have your SSN, they could try and open new financial accounts, apply for a loan or even get a job or visit the doctor using your information. Likewise, if a cybercriminal commits crimes using your SSN, they end up on your criminal record.

If a year's subscription to credit and identity theft monitoring isn't enough for you, Murphy Law Firm has begun investigating claims on behalf of affected individuals. In fact, the law firm is currently putting together a class action lawsuit and you can join it here.

Data breaches like the one detailed above are becoming all too common but at least this time, Landmark Admin did the right thing by providing affected individuals with identity theft and credit monitoring. As for the data breach itself, the company and law enforcement are still investigating and we could learn more about it in the future.

More from Tom's Guide

• NSA issues warning to iPhone and Android users — do this to stop hackers
• These are the best antivirus software solutions to secure your PC
• Hackers are using fake Google Meet errors to infect PCs and Macs with malware

Having a criminal record is bad enough as it is but what if information about your arrest, conviction and even your personal info was out there on the web for anyone to find? Well, that’s exactly what just happened to 70 million Americans.

According to a new blog post from Malwarebytes, a group of hackers who go by the names EquationCorp and USDoD have managed to steal and then leak a huge criminal record database online.

The database itself contains 70 million rows and includes the full names, dates of birth, known aliases, addresses, arrest and conviction dates, sentences and more of millions of Americans who had a run-in with the U.S. justice system between 2020 and 2024. 

In an email to Tom's Guide, a Malwarebytes's Pieter Arntz explained that "every record appears to be just one crime, or one arrest, as opposed to a record of all of the crimes of an individual person" which could be good news for those with lengthy rap sheets.

At this time, the exact source of the database is unknown, though we do know a bit about the hackers behind this leak. USDoD is a high-profile hacker group that has close ties to “Pompompurin” who ran the first version of the data leak site BreachForums. While that site has since been seized by law enforcement and shut down, the group was planning to create a successor to it. 

Malwarebytes’ researchers think that by releasing this new trove of leaked data, USDoD could be trying to stir up interest among other cybercriminals in their new data leak site. We’ll have to wait and see if this is the case but either way, here’s what you need to know if your criminal record data was exposed in this new leak.

How to stay safe after a data breach

Normally after a data breach of this magnitude, the companies involved would provide affected customers with free access to the best identity theft protection services. However, as this is the U.S. government we’re dealing with after all, that likely won’t happen. As such, you’re going to need to take matters into your own hands when it comes to protecting yourself from hackers and other cybercriminals misusing your criminal record data.

Since names, dates of birth, addresses and more were exposed in this data breach, there’s a lot hackers can do with your stolen information. From identity theft to targeted phishing attacks, you need to be extra vigilant online going forward. This means checking your bank statements for abnormalities and carefully scrutinizing any email from an unknown sender that ends up in your inbox. At the same time, scammers could try to reach you via mail since they do have your address.

As you could be exposed to malware and other viruses distributed through phishing emails, you want to make sure you’re using the best antivirus software on your PC, the best Mac antivirus software on your Apple computer and one of the best Android antivirus apps on your smartphone.

To see if your criminal record or other personal data has been exposed online, you can use Malwarebytes' own digital footprint scan, though there are other similar tools online, with Troy Hunt's Have I Been Pwned being the most popular.

Given that everyone affected by this data breach has a criminal record, we likely won’t see the same kind of attention that those impacted by a company that suffered a data breach would. Hopefully though, the U.S. government steps in to provide some safeguards for Americans whose personal data and criminal records have been exposed online.

More from Tom's Guide

• Microsoft patched a ton of Windows flaws including two dangerous zero-days
• 26 billion records exposed online in biggest data leak ever — what to do now
• This Android malware is stealing passwords by impersonating popular apps

Even though shopping online has now become the norm, you still need to be careful when buying products from lesser-known stores, as doing so could lead to hackers stealing your credit card information.

Case in point, the German cybersecurity firm SRLabs recently uncovered a massive network of 75,000 fake online shops called ‘BogusBazaar’, which over the course of three years, tricked more than 850,000 people into buying $50 million worth of fake goods.

As reported by BleepingComputer, online shoppers duped by these fake stores also had their credit card details stolen and then resold on the dark web. Not only can this lead to additional fraud but the information used at checkout on these fake online stores could be used to commit identity theft.

Whether you’re an avid digital shopper or just occasionally buy things from the web, here’s everything you need to know about this huge network of fake stores and how you can stay safe when shopping online.

Using expired domains to launch fake online stores

According to SRLabs’s report on the matter, most of BogusBazaar’s victims live in either the U.S. or Western Europe. Surprisingly, there are virtually no victims from China where the operation is likely located.

Since 2021, the cybercriminals behind BogusBazaar have launched more than 75,000 fake online stores. They do this by setting up these shops on previously expired domains with a good reputation, ensuring their fake stores show up in search results.

As seen in the picture above, most of these fake stores pretend to sell shoes and other apparel at very low prices. Likewise, they use custom names and logos to appear more legitimate.

Even though the stores themselves are fake, the cybercriminals running this operation used PayPal, Stripe and legitimate credit card processing services. In order to steal money and data from their customers, the operators of BogusBazaar have also developed custom WooCommerce WordPress plugins. For those unfamiliar, WooCommerce is a free plugin for WordPress that turns any site into an online store and is often used by the best website builders.

The group behind BogusBazaar is using an infrastructure-as-a-service model where a core team manages the operation’s infrastructure while the fake stores themselves are operated by a large, decentralized network of franchisees. 

While the operation itself is believed to be headquartered in China, the servers used for these fake stores are mostly located in the U.S. As such, it likely won’t be long until we hear about how government agencies took them down in order to disrupt the entire operation.

How to stay safe when shopping online

Even though you may want to support small businesses online, a story like this one could make you reconsider buying products from unfamiliar stores. 

While you could stick to large online retailers like Amazon, Best Buy and Walmart in order to stay safe online, sometimes it can be difficult to find more niche products at these larger online stores. For this reason, there are a couple of things to keep in mind when shopping at an unfamiliar online store.

To confirm that a store is actually real, you want to check out its contact information, examine the return policy, look for trust seals, browse through the entire site and also check its social media. This will help you avoid fake stores overall.

As BleepingComputer points out, many of the fake stores in this BogusBazaar operation use the same template: items are listed with their original prices crossed out and a new sale price—often more than 50% off—next to them. You can use the example image above from SRLabs to weed out fake stores from this campaign, too.

When shopping online, you also want to read reviews and use an online shopping checker like this one from F-Secure or even Bitdefender's Scamio before you head to checkout.  There are some other signs to look out for, too, which include examining a store’s URL for spelling mistakes and other errors, poor quality pixelated images, poor website design and an overly complex or non-existent return policy. The biggest red flag, though, is highly discounted prices. If a deal seems too good to be true, it likely is. This is why you want to price-check any products you're shopping for online before pulling the trigger.

Just like malicious apps and phishing attacks, fake online stores have been used by cybercriminals, scammers and other hackers for years to dupe unsuspecting shoppers. It’s up to you to look at them carefully and determine whether what looks to be a great deal is worth having your credit card information or identity stolen.

More from Tom's Guide

• Scammers trick Android users into installing a fake antivirus app that's actually malware 
• Your browser’s spell check feature could be giving away your passwords
• 34 million Americans were scammed last Black Friday — how to shop safely this year

Unlike when your Facebook gets hacked or you fall victim to a phishing attack, your personal information can be exposed online through no fault of your own when a company you do business with suffers a data breach. However, this can also happen when a third-party service provider used by multiple companies is attacked by hackers.

As reported by BleepingComputer, the health management solution company HealthEC suffered a data breach over the summer and as a result, the personal data and health information of 4.5 million patients was stolen by hackers. While HealthEC isn’t exactly a household name, its health management platform is used by 26 different healthcare organizations in 18 states across the U.S.

For this reason, you’re going to want to be extra careful if you’ve used any of the affected healthcare providers or services over the past year as the data stolen in this cyberattack could easily be used to commit fraud or even identity theft.

Multiple healthcare providers affected

The data breach itself occurred between July 14 and July 23 of 2023, when hackers managed to gain unauthorized access to some of HealthEC's systems. Following an investigation into the matter that concluded in October 2023, it was revealed that patient’s names, addresses, dates of birth, Social Security numbers (SSNs), taxpayer identification numbers, medical record numbers, medical information, health insurance information and billing and claims information was stolen from HealthEC’s breached systems.

Based on a data breach notification submitted to the Attorney General’s office in Maine, it was initially thought that just over 100,000 people are impacted by this data breach. However, a new listing on the U.S. Department of Health and Human Services’ breach portal shows that the total number of affected individuals is actually much higher at approximately 4,452,782.

So far, there are 17 healthcare service providers and state-level health systems that have been impacted by the cyberattack on HealthEC. In a cybersecurity notice published on its site, the company explains that some of its affected business partners include Corewell Health, HonorHealth, Community Health Care Systems, State of Tennessee, Long Island Select Healthcare and others.

What to do next if your personal data was exposed

Unlike other companies that have fallen victim to a major data breach, HealthEC isn’t offering free access to the best identity theft protection services. However, its business partners may do so for their own customers.

As such, if you have been a customer of any of the affected healthcare providers and organizations, you’re going to want to frequently check your mailbox for any data breach notification letters. These letters often contain advice and steps you can take to protect your exposed personal data and they may also include a code to sign up for an identity theft protection service or a credit monitoring service.

HealthEC recommends that all affected patients carefully review their bank statements for signs of suspicious activity or fraud. Likewise, the firm also suggests they place a fraud alert on their credit file which is free to do. Alternatively, you may also want to place a credit freeze on your credit report to prevent anyone from taking out loans or mortgages in your name using your stolen personal information.

This is the second healthcare-related data breach we’ve seen in recent months and as healthcare providers and the companies they work with manage all sorts of personal data, this trend will likely continue as cybercriminals look for new ways to gain access to SSNs and other valuable customer data to use in future attacks.

More from Tom's Guide

• Nearly 5 million hit in massive loan data breach — see if you’re affected
• Credit freeze vs. fraud alert — what's the difference?
• I review ID protection services and these 10 things help me secure my identity online

With the ability to monitor all three major U.S. credit bureaus and create a merged credit report that hits all the highlights, PrivacyGuard has a different approach to ID protection.

It offers up to $1 million in insurance as well as some helpful utilities, Norton security software and a password manager. However, it falls short by not backing it all up with two-factor authentication and a VPN like others provide. 

On the downside, it is expensive and its online response was slow. Our PrivacyGuard review will help you decide if this is the best identity theft protection with the features you need at the right price. 

PrivacyGuard Total Protection review: Costs and what’s covered

There are three PrivacyGuard plans that differ in terms of identity and credit monitoring as well as cost. There’s a two-week trial period for all the plans that costs just $1, after which the service charges full price. 

All three service levels are available monthly but there are no annual plans. They all come with a secure browser, an encrypted keyboard and Norton Security Online.  

The Individual Protection subscription costs $10 a month, making it inexpensive but not the cheapest ID plan around. Forget about getting credit scores or monitoring, but the plan includes $1 million of insurance to cover stolen funds as well as an army of lawyers, consultants and accountants. It monitors your personal information, like driver’s license, credit cards and bank accounts, email addresses, phone numbers as well as the expected Social Security number and date of birth. The Individual Protection plan watches for address changes and scans the dark web for instances of your personal identifiers online. On the other hand, it lacks payday loan protection as well as watching for home title changes and doesn’t have two-factor authentication. 

PrivacyGuard’s Credit Protection trades the insurance for credit scores and monitoring at $20 a month. It includes credit monitoring, scores and tracking for all three bureaus as well as VantageScore 3.0 ratings for each. Its monthly merged credit report includes aspects from each service as well as credit simulators and financial calculators but lacks some of the details of the individual agency reports. 

The Total Protection plan costs $25 a month, puts it all together and was the plan I used. It’s a nice balance with PrivacyGuard’s $1 million in identity insurance and credit monitoring. Total Protection comes with Norton Internet Security malware scanning and defenses to protect a single Windows computer. By contrast, others can protect five or 10 systems or McAfee’s unlimited number of computers.

There are no family plans available, but the individual plans can be used by up to 10 children for Social Security number abuse. The company is not rated by the Better Business Bureau.

PrivacyGuard Total Protection review: How we tested

During the summer 2022, I signed up for and paid for PrivacyGuard’s Total Protection coverage with a credit card. Later, Tom’s Guide reimbursed me. Several times a week, I checked in with PrivacyGuard to see my credit scores using a variety of computers. I looked for alerts and saw if there were any new articles to read. After three months I canceled the service.

PrivacyGuard Total Protection review: Credit scores and monitoring

The Total Protection plan includes access to VantageScore 3.0 ratings based on data from all three credit bureaus. It’s not as good for predicting credit worthiness as FICO scores but can be an acceptable substitute to pretest your ability to get a loan. 

It uses the familiar open circle visual metaphor for the scoring but added items relevant to my actual credit history and rating, like derogatory or delinquent accounts and high real estate balances. The Summary section is chock full of useful details, with the three credit bureau data side by side for comparison. It shows things like current balance, credit card accounts and accounts under collection. PrivacyGuard is a great way to evaluate the bureau’s data and look for errors.

The bottom has links for disputing anything on the report. It’s a tease, however, because it leads to a form for getting the actual report. 

Total Protection keeps an eye on the dark web for your financial dealings like bank accounts. On the downside, it can’t take in your investments, although the company is working on adding that. However, the number of accounts it can track is limited to 10 banks and 10 credit cards. It does look for your Social Security number in all the wrong places though. 

PrivacyGuard Total Protection review: Insurance and services

The Total Protection plan includes $1 million in insurance in the event of an identity theft. The coverage is underwritten by the omnipresent AIG. It’s meant to cover lost funds as well as lawyers, consultants, investigators and getting new documents, like a driver’s license and passport.  

Lost work and travel are covered and you can recover up to $7,500 in lost wages and $1,000 for travel. They also promise to have a single person follow your case from start to finish. 

PrivacyGuard Total Protection review: Notifications and alerts

There’s a variety of credit-based alerts that can just as easily be an indication of overspending as an identity hack. It has a different way of showing alerts. Its Alert Radar is one of six main tabs and if you click on it, your Credit and Identity Alerts are shown. Click on any for the details. 

The alerts can be personalized to how big a change triggers the notification as well as if the risk level changes. My favorite is the ability to select a target score and get a gratifying signal when you’ve reached it. Nothing like positive reinforcement.

The service monitors public and court records as well as new accounts opened in your name. However, it lacks home title checking as well as payday loan monitoring. 

Over my three month evaluation of PrivacyGuard, it sent me two alerts that concerned information I hadn’t filled out in the online forms.

PrivacyGuard Total Protection review: Setup

Privacy Guard’s on-boarding process was a snap. After finding the right plan on the company’s website, I clicked on “Start enrollment”.

I needed to add my email, a username and password for the service. I unchecked the box that would have allowed Privacy Guard to send me marketing information. Next, I typed my name, address and date of birth.

This was followed up with me clicking on “Yes, sign me up”. After answering five challenge questions about cars, loans and the year of my birth, I was done and received a summary page with a membership number.

The first online form asked for my username and a password; oddly, the password creation field rejected punctuation marks, which could potentially have made the password stronger; PrivacyGuard is working on updating this. The next forms wanted my name, address, date of birth, Social Security number and a credit card for payment; PrivacyGuard doesn’t accept PayPal.

Last item: I needed to install the PrivacyGuard app on my Samsung Galaxy Note 20 phone. This took less than a minute and I was ready. My scores were on screen a moment later. All told, it took less than 7 minutes.

The company’s tech support technicians are available only from 9 a.m. to 8 p.m. ET on weekdays as well as 9 a.m. to 5 p.m. on Saturdays. On the other hand, if you’re in the throes of an identity theft, they’re there for you with 24/7 service. If you have any credit anxieties, the Credit Information Hotline can help with answers to key credit report questions.

There are PrivacyGuard support links and phone numbers at the bottom of most pages of the web interface. My emailed request for information on how to use the interface was responded to in a few hours with a suggestion to call the tech-support number instead.

PrivacyGuard Total Protection review: Interface and utilities

To get connected to PrivacyGuard’s online services, I needed to enter the last four digits of my Social Security number for the page to load. It’s not as secure as two-factor authentication but is better than nothing. 

It can be one of the more frustrating identity protection services to use day-in and day-out. That’s because it can take 15 seconds or more to actually log in and double that for some pages to load. This can seem like an eternity if you fear something is amiss with your credit or online identity.

PrivacyGuard’s web-based browser presents a lot of data in a long strip and requires some judicious zooming. Setting the browser on my HD system to 33% takes nearly everything in while 50- or 67% makes it all readable but with some scrolling up and down.  Happily, most of the pages have contact information for easy access in an emergency.

The meat of the interface is the Credit Gateway that shows all three bureau VantageScore 3.0 ratings above the major factors that went into the scores. It has a print command in the upper right that will produce a combined set of credit reports with everything from personal information and credit inquiries to derogatory information and public records. It’s all below but this one-click print option is an unexpected bonus.

There’s also a score tracker for watching the three VantageScore ratings change over time. Oddly, it’s next to a mortgage calculator. The service has some of the best financial simulators available anywhere.

The support center has lots of useful, though, general, credit information, like how to pay off credit cards and lower your score. Unfortunately, none of the articles are dated.

Next over is the Account section, which is the place to set preferences for emails and texts alerts as well as the Score Tracker alerts. There’s an excellent Q&A section about the plan with details listed. Over to the right, there is an icon for logging out.

Its utilities are useful and deep, starting with Norton Internet Security for stopping malware. The plan included a secure browser extension that can be loaded onto three computers and works with iPhones and Android smartphones but not PCs or Macs. There’s also a secure keyboard that encrypts its traffic to thwart a hacker’s keylogger program from reading your character strokes. On the downside, there’s no VPN or password manager.

The app has a similar color scheme and design as the web version, making the transition easy. The scores are at the top with the four major functional activities – Identity Watch, Alert Radar, Credit Gateway and Score Tracker – below.

PrivacyGuard lacks two-factor-authentication to prove that you are actually you to see your vital data and make changes. The company is working on adding this vital piece of security software soon, but at the moment log-ins require the last four digits of your Social Security number.

It’s more secure than a password only log-in but it risks abusing the last part of your Social Security number.

PrivacyGuard Total Protection review: Cancellation

The service can be canceled by phone, email or on the website. Go to the Account section and on the right is a “Cancel Membership” link. The next page warns about losing coverage, but all I needed to do was to confirm the cancellation. I was also given a confirmation number for the cancellation.

PrivacyGuard Total Protection review: Bottom line

The Total Protection plan from PrivacyGuard combines three-bureau credit monitoring and scores but stops short of providing the actual reports behind the scores. Instead, the company creates a merged report with most of the highlights that can make comparisons easier. Its security software is good with Norton malware protection and an encrypted keyboard, but it lacks a VPN.

Its credit simulators can be a big help in figuring out what to pay first, but PrivacyGuard’s slow response can make it frustrating to use, particularly when your identity is on the line.

Unlike with a cyberattack, you can get caught up in the fallout of a data breach even if you did nothing wrong. This is the case for 1.1 million Americans who may have had their financial data exposed following a recent breach at a major debt collector.

As reported by Cybernews, the US-based debt collector NCB Management Services has begun sending out data breach notification letters to users as the result of a breach that occurred back in February.

NCB claims that at the beginning of February, hackers gained access to its systems. Unfortunately though, it took the company three days to realize it had been breached.

Following an internal investigation, NCB submitted a data breach notification to the Maine Attorney General explaining that the hackers responsible accessed financial account numbers or payment card numbers along with security and access codes, passwords or PINs for the accounts of affected users.

This amount of financial information being exposed is quite concerning as users’ credit cards could end up for sale on the dark web. From here, hackers could use them to commit fraud or even identity theft if other sensitive data on affected users is also available online.

Banks are also caught up in the fallout

As NCB is a debt collection agency after all, it’s used by banks to collect any outstanding amounts owed. So far, it looks like both TD Bank and Bank of America have been indirectly affected by this data breach as well.

In a recent report on the matter, the legal advice site JD Supra explained that TD Bank customers could be affected from the NCB data breach as well. This is based on an official filing the Toronto-based bank also made with the Main Attorney General explaining that the hackers responsible gained access to the names, addresses, account numbers, dates of birth and Social Security numbers of its customers.

Just like NCB did, TD Bank has also sent out data breach notification letters to customers who were impacted as a result of this data breach.

In a sample notice letter (PDF) submitted to the Maine Attorney General which was sent out to impacted users, NCB revealed that Bank of America customers may also be affected. According to the letter, hackers may have accessed their first and last names, addresses, phone numbers, email addresses, date of birth, employment position, pay amount, driver’s license numbers, Social Security numbers, account numbers, credit card numbers, routing numbers and other sensitive info during the breach on NCB.

How to tell if you’re affected and what to do next

If you’ve been contacted by NCB regarding debt collection before or are a Bank of America or TD Bank customer, you want to be on the lookout for a data breach notification letter in your mailbox. You may also receive an alert via your banking app or if you log into your account from your browser.

Although we don’t yet know if TD Bank is offering customers free access to the best identity theft protection services, Bank of America has said that it will provide affected customers with a two-year subscription to Experian IdentityWorks. You can find all of the details on how to activate the subscription in the data breach notification sent out by NCB if you received it.

Going forward, users caught up in this data breach should carefully review their credit reports and account statements for the next 12 to 24 months to look for any signs of suspicious activity.

As for which group of hackers is responsible for the breach, NCB has said that it is working with federal law enforcement agencies to get to the bottom of things. However, the company could end up paying a fine due to the fact that hackers had access to its systems for several days without being detected.

More from Tom's Guide

• This new phishing scam can steal your Social Security number
• Nearly 5 million hit in massive loan data breach
• PayPal hacker attack exposes customer names, Social Security numbers

For the past few years every fall I have spent several months using and reviewing the best identity theft protection services. So far (knock on wood), I have avoided having my identity hacked and kept my online identity protected, but it takes some effort.

No technique is foolproof but my key to staying safe and secure online is to create a defensive wall around my computers and information. It ranges from using the best antivirus software and identity protection services to being careful about what attachments I open and keeping my identity close to the digital vest. 

These 10 protective practices have helped keep my secrets close to my digital vest and they can help keep you safe too.

Subscribe to an ID protection service

Protecting my identity online starts with an effective and thorough ID protection service. It needs to combine monitoring the dark web for evidence of my data showing up in the wrong places, watching my credit for the early signs of a break in and include identity protection insurance as well as experts to make things right after a break in. 

My favorite is Bitdefender Ultimate Security Plus, which combines the company’s excellent malware protection with Identity Force’s thorough ID protection and three bureau credit monitoring. The good news is that many employers and insurance companies offer some form of ID protection as a free or low cost option. In other words, there’s no excuse not to sign up for identity theft protection.

Set alerts for transactions

One of the best parts of using credit monitoring is that it can be an early warning signal that someone might have access to my accounts. It might be a hacked credit card, a password that’s used too much or just that someone peeked over my shoulder while using an ATM machine. 

Most, but not all, ID protection services have transaction alerts for credit or debit accounts to show potential surreptitious use. The key is to set a comfortable level that is low enough to avoid large losses but not so low that I ignore them. I set mine at $250 and if the transaction is not valid, I am able to quickly lock my credit. (Here’s how to freeze your credit with Experian and TransUnion.

Don’t open email attachments that look suspicious

We all get lots of emails and hidden inside too many are phishing links or attachments aimed at stealing log-in credentials. I have three rules that have worked over the years: I need to recognize the email address of the sender, it has to look legit and the grammar and wording have to make sense. 

I get lots of emails purporting to be from places like BestBuy, Norton or – in this case – the Post Office, that fail the test. Here, the signs couldn’t be clearer: the complex return address doesn’t contain USPS.com, the lack of the USPS eagle and the plum color of “USPS” rather than the standard purple and I’ve never seen an exclamation point used in a post office email. It all adds up to a fake email aimed at getting me (or you) to click on the “Check Here” box. These rules may not help as cybercrooks get smarter and use artificial intelligence to make these emails more convincing.

Use updated Anti-Malware software

Regardless of which platform is used, all computers – including phones and tablets – need effective antivirus protection that’s frequently updated with signatures for the latest exploits. The best malware packages update their databases hourly if not more frequently during a viral onslaught. 

Any of the major security suites will more than adequately protect a notebook, tablet and phone from a variety of viral agents, old and new. That is, with one major exception: Apple refuses to let security apps scan iOS-based iPhones and iPads for malware that might compromise the system and its data. However, Intego Mac Premium Bundle X9 gets around this by letting you scan iPhones and iPads connected to one of the best Macs with a USB cable.

2FA, all the way

I set my online accounts to require two-factor authentication (2FA), and if the service doesn’t offer this security-enhancing option, I have to think twice. Sure, it can be a pain to have to get and enter a six digit code to do anything from watching Apple TV Plus shows to checking my credit card balance but this is an effective way to prove that I actually am me. I lighten the security overhead with fingerprint or facial recognition log ins that can speed up getting into the account. The only real frustration is that it rarely works for me on the first try. 

Require HTTPS security

Before I enter any personal data or make a purchase online, I make sure the website’s URL starts with HTTPS. This means that the computers at both ends of the digital conversation are using a Hypertext Transfer Protocol Secure online session that uses 128-bit AES encryption and enables Transport Layer Security (TLS). In essence, it creates a secure channel over the inherently insecure Internet that only allows the legitimate recipient to decode the data and see what I’ve typed. For online banking, I also use an on-screen keyboard to further protect my passwords. 

Dedicate a single credit card for online purchases

My favorite online identity security tip is the easiest to use every day. I have a Discover card that I only use for online shopping. This makes tracking and paying for my online purchases a snap and means that if the card is ever compromised, it is easier to figure out what happened. Rather than tracking several cards and accounts, fixing things with a new card and account is a one stop affair. Luckily, it has not come to that, and I get a healthy cashback bonus that I use for an occasional treat.

Use a password manager

Unless you are a memory superstar, like Alex Mullen, the idea of remembering a different password for each online account is just a pipe dream. There is a way to avoid using “passw0rd” over and over and over again that can make my online life more secure. The major browsers have built-in password managers but using one of the best password managers like 1Password can consolidate all my log-in credentials into one super-strong master password. It not only makes logging in easier across all the major computing platforms but has a place to keep digital versions of my driver’s license and passport along with 1GB of encrypted online storage space.

Shred old documents

In an age of instant-access to digital information, thinking about paper documents might seem quaint, but old tax returns, receipts and even credit card bills contain information for enterprising hackers to exploit. Called synthetic identity fraud, crooks might combine an account number from one, a birthday from another and an address from a third, creating enough to start a break-in. 

My approach is to toss the things I can’t safely throw away into a Fresh Direct bag. When it’s filled, I take it to FedEx where its contents are put into a locked garbage can for secure shredding by Iron Mountain. Sure, at $1.50 a pound, it’s expensive but the alternative can be more costly.

Wipe old digital devices

My new Google Pixel 7 phone is shiny, powerful and is quickly making me forget my beat-up old Samsung phone. The problem is that I want to turn it in to get a $100 rebate. Before I mail it in, though, it needs to be wiped of my data or who knows where it might end up. 

To clear the contents of my phone, or any Android 13 device, I started at the Settings section’s System category and tapped Reset Options. Erase all data did the trick. To wipe an iPhone running iOS 14, start at Settings, tap on General Reset and then Erase all Contents and Settings.

Making security a habit

While these items are the major ways I secure my identity, there are dozens of little things I do everyday that are second nature to me, like using a mobile hotspot or one of the best VPNs instead of public Wi-Fi. In fact, the more I do, the easier it is to sleep at night.

More from Tom's Guide

• Google is killing passwords and replacing them with passkeys
• I’m a security editor and this is how I create strong passwords
• Malicious Android apps are signing users up for paid subscriptions

The holiday shopping season has started early this year and there are already some great Black Friday deals to be had. However, while Black Friday is one of the busiest days of the year for retailers, this also holds true for cybercriminals.

According to Adobe, American shoppers spent almost $9 billion last year on Black Friday alone and cybercriminals certainly want a piece of the action. This is why they’ve already begun setting up fake websites, email addresses and more to try and con shoppers out of their hard-earned cash.

Checking off everyone on your list this year while saving quite a bit of money is one of the best reasons to shop online this Black Friday. However, if you have your bank account emptied or your identity stolen in the process, you’ll actually end up losing more than you saved. 

To help you safely find the best deals on the biggest shopping day of the year, these are the most common Black Friday scams along with some tips on how to avoid falling for them and even some steps you can take if you do get conned. 

The most common Black Friday scams

The cybercriminals behind many of the Black Friday scams detailed below are trying to play on your emotions to instill a sense of urgency. When you’re excited about a great deal or worried you might miss out on it, you are much more likely to take unnecessary risks like shopping at an unfamiliar site or providing sensitive information you wouldn’t normally give away. In order to shop safely on Black Friday, these are the top six scams you’ll want to be on the lookout for.

1. Fake order scam

If you’re buying gifts for all of your friends and family this Black Friday, you may find it difficult to keep track of all of the order confirmation emails in your inbox. Cybercriminals are well aware of this and use it to their advantage to send out fake order confirmation emails. These emails will likely have links to fake websites that are used to harvest your credentials but they may also arrive in your inbox with malicious attachments that contain malware. It's worth noting that we've also personally seen fake text messages impersonating Amazon trying to achieve the same result.

To avoid accidentally opening and interacting with one of these fake order scam emails, McAFee recommends in a blog post that you should keep track of your orders on the sites where you purchased them instead of in your inbox.

2. Fake delivery scam

If you’re ordering lots of things online this Black Friday, you’re going to get a lot of delivery notifications. Cybercriminals use this to their advantage to send out fake delivery notifications impersonating popular shipping companies like FedEx, UPS or USPS either by text or email. Just like with fake order scams, these messages contain a link and encourage you to click on it to accept your delivery. However, these links will take you to a phishing page instead where your credentials and other sensitive information will be harvested by cybercriminals.

3. Fake website scam

Cybercriminals and other scammers will often purchase the domains of misspelled sites that are close to those of actual retailers. Some examples include ‘amozon.com’ instead of Amazon or ‘homdepot.com’ instead of Home Depot. This is called typosquatting and this scam is used to target shoppers who misspell a website’s URL in their browser’s address bar. 

Even if you’re a great speller, someone may send you a link to one of these websites in an email or text message. This is why you want to go to the sites of retailers directly or use a search engine if you don’t know the address of their website.

4. Gift card scam

Besides targeting Black Friday shoppers through email or text, cybercriminals also do so at checkout. One of the ways they do this is through gift card scams where they ask them to pay using a gift card instead of a debit or credit card. The reason for this is that gift card purchases can’t be tracked which makes it impossible to retrieve your stolen funds. It’s also worth noting that scammers can imitate popular gift cards in an attempt to steal any cryptocurrency you may own according to a blog post from Aura.

5. Fake charity scam

During the holiday shopping season, many retailers give shoppers the option of donating to charities at checkout. This has also become a popular gift for those on your list who may not need anything. Cybercriminals often take advantage of the season of giving by setting up fake charities. You can spot a fake charity by the language used in any emails or messages you receive as the scammers behind it will often urge you to “act now.” At the same time, these fake charities will ask for payment in the form of gift cards, wire transfers, money orders or even cryptocurrency because just like with gift card scams, once money is sent using these methods, it can’t be recovered.

6. Hot deal scam

When it comes to Black Friday scams, scarcity is something cybercriminals often try to exploit. Each holiday season, there is usually a super-popular gift that everyone wants to get their hands on (like Tickle Me Elmo back in 1996). To target shoppers looking for this particular item, cybercriminals set up fake websites (often using typosquatting) and they may even buy ad space online to promote them. If you fall for the hot deal scam, not only do you not receive the item you thought you purchased but your payment information is now in the hands of scammers.

How to avoid getting scammed on Black Friday

Now that you know the most popular Black Friday scams, here are some tips on how you can avoid falling victim to them. Keep in mind though that new scams are discovered every day. However, if you follow these tips and remain vigilant when shopping online, you can get some great deals on Black Friday without getting hacked.

1. Only shop at known, trusted online retailers

Black Friday, Cyber Monday and other big shopping days are a terrible time to look for and try out new online retailers. Instead, you want to stick with the big brands you know like Amazon, Best Buy, Target and Walmart. This way you can be sure that you will receive the items you buy on Black Friday instead of being scammed.

If you see a deal that seems too good to be true this Black Friday, the Better Business Bureau recommends that you “read product reviews on extremely discounted items” as they could actually be a cheaper model and not what you expected.

2. Carefully examine every site you shop at

Problems like broken links, typos or slow-loading pages can be a dead giveaway that you’re on a scam site and not an official one. Likewise, you will want to carefully examine the web addresses of all the sites you visit on Black Friday. If you see a typo in the URL or the wrong TLD (top-level domain) like .live instead of .com, you’ve found a scam site. 

To see full web addresses in Chrome, right click on your address bar and then click on “Always show full URLs” to enable this feature.

3. Use a credit card instead of your debit card

Even though your debit card is where the money you have to spend actually is, you’re going to want to use a credit card to shop on Black Friday instead. Unlike with a debit card, you can get your money back when using a credit card to shop online. This is because the Fair Credit Billing Act (FCBA) makes both credit card companies and retailers liable if a product arrives broken or doesn’t arrive at all. Retrieving money lost to fraud is much easier with a credit card. 

4. Enable two-factor authentication on your accounts

Even though this is a good idea in general, you’re going to want to make sure that two-factor authentication (2FA) is enabled for your accounts this Black Friday. 2FA adds an extra layer of protection to your online accounts by requiring you to enter a one-time-use code sent via text or email when you login. If your passwords get stolen, a hacker won’t be able to login into your accounts unless they also have access to your smartphone or email account.

5. Sign up for identity theft protection

In the same way that 2FA adds an extra layer of protection to your accounts, the best identity theft protection can also help you stay safe when shopping online this Black Friday. If you do happen to fall for a scam and have your accounts or even your identity stolen by cybercriminals, these services have experts on staff that can help you recover stolen funds along with your identity. Likewise, one of the best VPN services can come in handy if you plan on shopping online while on public Wi-Fi.

What to do if you fall victim to a Black Friday scam

Even if you follow all of the recommendations above, you may still end up falling victim to a Black Friday scam since the cybercriminals behind them are persistent and quite clever. In this case, you need to take action immediately to limit the damage that one of these scams can do. 

1. Immediately notify the companies involved

If you see a strange charge on your bank statement or discover a fraudulent account when checking your credit report, you should contact the bank or organization involved immediately to let them know that you suspect fraud or theft. This will get the investigation process started and most companies have fraud departments with experts that can help you out.

2. File a police report

In addition to contacting a company, you should also file a police report so that you can get a case number to complete your claim as many businesses require you to do so. Even if they don’t, filing a report is a good idea as it can help clear your name if you do have your identity stolen. Also, you will want to save any statements or documents you receive as they can prove invaluable when dealing with fraud or identity theft.

3. Contact the FTC

If you believe you may have fallen victim to identity theft, you should contact the Federal Trade Commission (FTC) at this website to report fraud. Once you file a report, the FTC will provide you with a step-by-step recovery plan to get your identity back. By setting up an account with the FTC, they can even walk you through this process. At the same time, reporting theft to the FTC can be useful if debtors try to collect fake charges in your name.

4. Lock or freeze your credit

A credit freeze or credit lock can help stop cybercriminals that have stolen your identity from opening new accounts or taking out loans in your name. If you previously signed up for an identity theft protection service, this will be easy to do but if not, you will need to contact each of the major credit bureaus on your own to do so.

To make things easier, here's how to freeze your credit with Equifax, how to freeze your credit with Experian and how to freeze your credit with TransUnion.

5. Monitor your online accounts for signs of fraud

After falling victim to any scam, you’re going to want to keep a close eye on all of your online accounts, bank statements and credit reports for the next few months. Identity theft protection services include the tools to do this automatically but you can also do so on your own.

There are a number of things that can put your sensitive data at risk, from major security breaches to losing your wallet or having an invoice sent to the wrong address. No matter what it is, it only takes one mistake for your data to get into the wrong hands.

You may not even noticed that your identity has been stolen until your banking acocunts have been accessed and drained. To stay one step ahead of scammers, you need to make sure you’ve established the proactive protection that one of the best identity theft services can provide.

We put the top identity theft protection services to the test using our own personal data to prove they actually work. We tested them for dozens of hours, testing out all their different features — from contacting support and navigating the interface, to triggering alerts and trying out features to see which ones work best for which circumstances.

Whether you need the comprehensive coverage provided by LifeLock or a more budget-friendly solution like IDShield, we have recommendations to keep you and your whole family's data safe.

The quick list

The best identity theft protection software you can buy today

Best identity theft protection overall

Lifelock is one of the oldest identity theft protection providers, and it offers some of the most comprehensive coverage around. During testing, we were impressed by its features: you get everything from credit monitoring and alerts to dark web monitoring, scam protection, and a large amount of insurance. The service also offers traditional antivirus features like a VPN, malware scanning, and a password manager courtesy of an add-on with the Norton 360 security suite.

LifeLock offers $1 million each to cover lawyers, consultants, accountants, and experts in order to help you forensically examine and recover from an identity theft, credit card theft, or money stolen, and personal expenses such as lost work or the cost of getting new documentation like a passport or driver's license.

The service provides necessary features, including dark web scanning, credit score access with the Vantage 3.0 rating system, title change check, and sex offender alerts. It also has more extensive features that help protect users — like the Social Media Monitoring, which looks out for account takeovers and cyberbullying, a Privacy Monitor scan that monitors your information against data broker sites, and a Computer Tune Up utility.

All these features are nicely organized in an interface that makes them easy to find, with major services highlighted. We found it easy to navigate through, adjust settings, or find controls. While testing the service, most of the notifications he received were regarding bank transactions, though LifeLock will also send alerts over data breaches, sex offenders in the neighborhood, or if a utility is opened in your name (among other issues).

Given that it can be paired with Norton 360 antivirus protection, LifeLock is clearly a product intended for those who want all the features – and who aren’t afraid to pay for it. It provides comprehensive identity theft protection with an amazing array of features, including an antivirus add-on that is known to be feature-rich, and includes utility add-on’s for those who want even more.

• Read our full LifeLock review

Best identity theft protection on a budget

The least expensive identity protection service on our list doesn’t lack in features or protection. Aura offers three tiers: for individuals, couples, or families, and all three tiers include monitoring and scores from all three credit bureaus and a Vantage 3.0 rating.

Aura will monitor both bank and investment accounts using Plaid, and send alerts if it finds any duplicate charges, transactions that go over your preset limit, bankruptcy proceedings in your name, sex offenders in your neighborhood, and more.

Despite its low monthly rate, it also offers a 24/7 White Glove treatment which provides a single case manager to handle an identity theft case from start to finish. That means if you have an issue, you only have to deal with one person to get back any new identity documents or resolve any issues. The plans cover between $1 and $5 million of identity insurance to protect against credit card fraud or someone draining your bank account.

When we tested Aura, we found its interface particularly easy to navigate and we appreciated that it didn’t leave out features. It includes a credit lock button (for Experian), dark web monitoring, malware scanning, a password manager, VPN, sex offender and cyber bullying alerts, a Safe Gaming app which keeps an eye on in-game commenting, and a 24/7 customer support number, among others.

• Read our full Aura review

Best identity theft protection for families

McAfee has paired its antivirus software with TransUnion’s identity services to create McAfee+ Ultimate, a comprehensive package for the age of cyber theft. We found McAfee+ Ultimate to be a well-integrated solution with a common look and feel for generally easy use and navigation.

It simplifies combining identity protection with security software and includes antivirus protection for an unlimited number of devices, as well as up to $2 million in identity theft insurance and an extra $25K in ransomware funds. There is also daily access to credit changes from all three major credit bureaus with scores, monitoring, and freezes.

McAfee+ Ultimate’s dashboard has boxes with numbers that clearly indicate any items that may be found in data breaches, as well as other metrics like how many devices are covered and more. It’s built around TransUnion offerings, so it includes features such as a TransUnion credit lock, however the Ultimate tier includes Equifax and Experian credit reporting as well.

Like the other services on this list, it provides a VantageScore 3.0, but it also gives an explanation of the items that affect that score as well as credit improvement advice. McAfee will provide access to lawyers, accountants, and detectives to investigate and remediate an identity theft, and provisions for lost wages and travel if needed. Plus, it includes a Personal Data Cleanup tool that can scrub your information from data broker sites.

During testing, we found the Online Account Cleanup particularly useful; the feature finds all the accounts associated with your email address. Likewise, he was impressed by the Protection Score that gives an overall safety rating and tells you which features of the program you have enabled.

On the antivirus side, McAfee+ Ultimate’s program provides multiple scanning options to check for malware, and doesn’t slow down a system even when the VPN is enabled. Its integrated Scam Detector can warn you about any text, image, video, or email scams that are geared toward you. Because of the unlimited devices covered and the features that can easily improve your online safety, McAfee+ Ultimate is a good pick for every member of the family.

• Read our full McAfee + Ultimate review

Best identity theft protection for security

Another service that uses TransUnion credit monitoring, reports, and identity insurance, Bitdefender pairs it with its own malware protection in order to cover all the most important parts of a busy online life. Bitdefender Ultimate Security Plus provides up to $2 million of identity insurance and credit freeze, through TransUnion, as well as malware scanning, a password manager, and a VPN.

Bitdefender’s base subscription includes credit reports and monitoring from TransUnion, but the extended account has reports and monitoring from Equifax and Experian as well. Credit reports are available on a quarterly basis, but there is daily access to a Vantage 3.0 score.

The service can track up to 10 bank and investment accounts, and keeps track of key personal accounts like passports, drivers licenses, and credit cards. It will send alerts about suspicious activity like address changes and payday loans.

While testing Bitdefender Ultimate Security Plus, we liked the BreachIQ feature that told him if his data was being exposed and also provided him with an identity Safety Score. It showed data leaks with related dates and a rating; the service then gave actions to mitigate exposure.

Plus, the credit simulator lets users play out different scenarios for how to best pay off debt. On the antivirus side, another helpful inclusion was the Scam Alert, an AI-powered utility that analyzes texts, images, and audio to determine if they’re fraudulent. Bitdefender Ultimate Security Plus’ focus on online security makes it ideal for those who want to include identity theft services with their antivirus protection.

• Read our full Bitdefender Ultimate Security Plus review

Best identity theft protection for privacy

IDShield will not only provide the basic needs for identity theft protection, like monitoring credit, limiting rogue transactions and keeping an eye on investments, but it also offers many useful tools to protect your privacy online.

IDShield provides access to a Reputation Manager which can scan your social media accounts for any inappropriate content you may want to clean up. It also has a Privacy Check feature that works with data broker sites to find any instances of your information that may have leaked, and then removes them.

IDShield has four tiers of plans to cover either individuals or families with up to $3 million in identity theft insurance to cover stolen funds. During testing, it did a good job of delivering and monitoring Experian scores, though it doesn’t have access to full credit reports or show scores from the other agencies it does monitor suspicious activities from them and provide a Vantage 3.0 score.

It will also provide lawyers, accountants and investigators to assist with restoration, and includes antivirus software from Trend Micro for malware protection. It can also watch for your information on the dark web and at payday loan establishments, and keep an eye on medical records. IDShield will send you alerts about any bank and investor accounts, for social media monitoring and sex offenders in your neighborhood.

• Read our full IDShield review

Also tested

Not every identity theft protection service can be the best. The ones we've included above are the ones that really stand out for their features and value, but we test plenty more. Here are the services that didn't quite make the list but are still worth your money if you're after more options.

How we test and rate the best identity theft protection services

Our testing and analysis of the best identity theft protection services focuses on how well each one monitors credit information, financial activity and personal information. We also rate each service for how frequently it provides credit reports and credit scores (not including free annual credit reports).

We give extra weight to the services that offer tools to help improve your credit score, and penalize services that do not give you credit reports from all three credit bureaus. We also rate each service for the number of credit cards, debit cards and bank accounts they’ll monitor and paid close attention to whether or not a service provides email or SMS notifications for large changes to account balances or large expenses on a credit card.

We penalized services that didn’t allow us to add any personal information beyond our Social Security number, such as driver’s license number, phone number or multiple email addresses; this is all information that can be used to steal your identity and that is commonly taken in a data breach. We also gave extra points to services that detected any compromised personal information.

We spent months trying out all the services on this list with actual personal information. During this testing period, our reviewer used his own credit cards and bank accounts to sign up for each service then used his accounts as usual to look for signs of identity theft. He also opted into all email, SMS or phone alerts and regularly checked credit reports to monitor for changes.

Additionally, he tried out all the available features of each service to see which ones proved useful, helpful or clunky, poked through the user interface on both desktop and mobile to see how user friendly it was, and contacted customer support to see if they were responsive.

How to choose the best identity protection service for you

Many of the services we've reviewed in this guide work in similar ways — they monitor the three major credit bureaus for your information, and will send you an alert if something worrying pops up. All of them monitor the dark web, and some will additionally search data broker sites for any mentions of your personal information, for example, your name, Social Security number, credit card, and/or bank account numbers.

Each of the services on this list will send you alerts should anything come up, usually via text or email. Additionally, they are all accessible via desktop or mobile apps on Android or iOS.

If the worst comes to the worst, and your identity is in fact stolen while you're paying for one of these services, each of the services we've reviewed here will cover up to $1 million or more to restore your reputation and credit. This can sometimes include reimbursement for stolen funds and lost wages.

So, we've covered what's the same, but what's different?

The main differences between the services are how frequently you'll receive credit reports and scores from them, as well as the specific bureaus you'll receive these credit scores from. Additionally, not all the services monitor your bank, credit card, and investment accounts, and not all of them will offer home title change alerts either.

Others offer more online safety tools, for example, features regarding cyberbullying, sex offender alerts, and parental controls, like game modes. Others will also bump up their security by offering two-factor login authentication — a real bonus considering 2FA is a recommended step in protecting your accounts against hackers and account break-ins.

FAQs

With summer vacations getting underway, searches for “avoid ID theft” have skyrocketed by 1,600 percent online as travelers look to protect themselves from identity theft ahead of their next big trip.

To determine if traveling heightens people’s anxieties about identity theft, security researchers from the cybersecurity firm McAfee analyzed Google Search trends to find a major uptick in the number of users concerned about falling victim to identity theft this summer.

Likewise, searches for “worst city for pickpockets” increased by 400 percent ahead of the summer travel season. While pickpocketing isn’t a cybercrime, it can be used to facilitate a number of online attacks including fraud and identity theft as an attacker can find out quite a bit more information about you and make fraudulent charges to your credit cards with your wallet and driver’s license in hand.

If you want to avoid being pickpocketed this summer, Barcelona, Rome, Prague, Madrid and Paris are some of the most well-known places where this crime often occurs. This is likely due to the fact that they are some of the most highly coveted summer travel spots in Europe which are packed with tourists each year.

As identity theft can often take months or even years to recover from, knowing what to be on the lookout for along with some simple steps you can take to be more secure while traveling can make all the difference between a summer vacation you’ll look back on fondly and one you’ll regret taking.

Different types of identity theft

According to a new blog post from McAfee these are the five most common types of identity theft: financial identity theft, medical identity theft, criminal identity theft, synthetic identity theft and child identity theft.

Of these, financial identity theft is probably the one you’re most familiar with as it involves a cybercriminal stealing your financial information like your credit card number to make fraudulent purchases. The others are less widely known but you should still be aware of them to protect your identity online.

Medical identity theft for instance involves someone stealing your personal information to obtain health care services. In this case, someone may use your identity to obtain prescription drugs. Criminal identity theft occurs when someone else uses your name when arrested. If this happens, you’ll likely receive a court summons that you had no involvement with which may leave you quite confused.

Synthetic identity theft, on the other hand, is relatively new and it involves a cybercriminal creating a fake identity using your real information. For instance, they might create a fake identity using your real birth date and Social Security number to apply for a loan.

Finally, child identity theft is where a cybercriminal uses the personal information of a minor to commit bank fraud or another form of identity theft. Since children aren’t regularly monitoring their credit, this type of identity theft can often go undetected until they become of age and want to apply for a credit card or loan.

When it came to the most reported types of identity theft last year, the FTC reported that over 300,000 people reported falling victim to credit card fraud or other types of identity theft. Meanwhile, 264,000 people reported that fraud was committed using their government documents or benefits. Over 100,000 people reported falling victim to loan or lease fraud, bank fraud and employment or tax-related fraud while phone or utilities fraud affected more than 80,000 people last year.

Places to avoid traveling to in the U.S. if you’re worried about identity theft

As many people don’t yet feel comfortable traveling overseas after the pandemic, you may be planning to travel within the U.S. this summer. However, there are certain states and cities you may want to avoid if identity theft is a pressing concern.

Of the 50 states in the U.S., Rhode Island had the most reported cases of identity theft last year with 2,857 reports per 100,000 residents. Kansas took the second spot with 1,355 reports followed by Illinois with 924 while Louisiana and Georgia round out the top five at 732 and 618 reports, respectively.

When it comes to the metro areas with the highest cases of identity theft, Providence, Rhode Island took the top spot with 1,981 per 100,000 residents. Lawrence, Kansas came in second with 1,779 reported cases followed by Topeka, Kansas with 1,548. Wichita, Kansas came in fourth with Lafayette, Louisiana rounding out the top five.

The age groups that are most likely to fall victim to identity theft

With so much of our personal information available online these days, anyone can fall victim to identity theft. However, as McAfee notes, certain age groups are more likely to experience different types of scams.

For instance, baby boomers are more susceptible to scams like benefits fraud while millennials who have grown up with the internet are more likely to fall victim to credit card fraud as they prefer to shop online.

Based on FTC data from last year, almost 200,000 baby boomers or older fell victim to identity theft last year which means they’re slightly more susceptible than Gen Z at 145,000. Surprisingly, Gen X was hit the hardest by identity theft with 555,000 members of this age group falling victim followed by just over 500,000 millennials.

What to do first if you think your identity has been stolen

To avoid falling victim to identity theft, you should always be on the lookout for signs that someone has stolen your identity. You can do this by regularly checking your bank statements and credit reports to look for extra chargers to your account. However, you should also be mindful of red flags like bills that arrive at your home with your information but someone else’s name, mysterious calls from debt collectors or emails from new online accounts that you don’t remember registering for.

If you believe your identity has been stolen, the first thing you should do is reach out to law enforcement as some banks may require that you show them a police report before being reimbursed for fraudulent charges or withdrawals. You should also contact the company where your identity is being used and let them know what’s happened.

From here, you should get in touch with three big credit bureaus and call or message TransUnion, Equifax and Experian right away. By doing so, they may be able to help diminish the impact identity theft has on your credit score. However, you can also report identity fraud to the FTC to help spread awareness of the various scams and tactics currently being used by cybercriminals. The Identity Theft Resource Center is another helpful tool that can teach you how to prevent identity theft or aid you in recovering your identity.

Don’t let identity theft put a damper on your summer vacation

Some other things you may want to consider before setting out on your next big trip are installing a VPN on our smartphone so that you can stay secure on public Wi-Fi and checking your travel apps to make sure that they aren’t requesting any unnecessary permissions like access to your microphone, camera or camera roll.

Still though, with the right planning and awareness, you can have a wonderful trip this summer without worrying about unintended consequences when you get home. However, if you do think you may have fallen victim to identity theft, it’s always best to take action sooner rather than later to minimize the impact to your online accounts and your credit score.

The antivirus maker and cybersecurity firm Bitdefender has unveiled its new identity theft protection service for consumers in the US.

Bitdefender Identity Theft Protection provides users with identity threat detection and alerts, 24/7 credit and financial account monitoring as well as dedicated recovery services they can turn to in the event of a successful identity takeover.

The new service combines advanced threat detection and dark web threat intelligence with 24/7 identity, privacy and credit monitoring to protect users against the theft, sale or illegal trade of their personal, financial and credit monitoring.

If your identity should happen to fall into the wrong hands, Bitdefender Identity Theft Protection promises to provide 24/7 support services where certified US protection experts do most of the necessary work for you including freezing compromised accounts, contacting third parties and completing the paperwork needed to restore your identity. 

At the same time, Bitdefender’s identity theft insurance guarantees up to $2 million to cover certain out-of-pocket expenses, lost wages and funds stolen from your financial accounts if you happen to fall victim to identity theft.

Bitdefender Identity Theft Protection

Bitdefender developed its new identity theft protection service in collaboration with IdentityForce and it’s now available as a standalone subscription or through Bitdefender Ultimate Security which combines Bitdefender Total Security, Bitdefender Premium VPN and Bitdefender Password Manager in a single subscription.

For those considering signing up for Bitdefender Identity Theft Protection on its own, a Standard subscription costs $89.99 for the first year while a Premium one costs $139.99 for the first year. The difference between the two plans is that the premium plan provides credit report monitoring from three bureaus instead of one; identity theft insurance also increases from $1 million to $2 million and damages from ransomware and fraud can also be reimbursed.

Ciprian Istrate, vice president of Bitdefender’s consumer solutions group, explained in a press release why the cybersecurity firm has decided to launch an identity theft protection service in addition to its antivirus and VPN:

“As consumers conduct more personal business and finances online, they need complete cybersecurity protection that not only blocks threats like malware and phishing attempts, but also protects digital privacy and actively secures personal data against theft and misuse. Bitdefender Identity Theft Protection service enables consumers to enjoy online shopping, banking, social media and other activities with peace of mind knowing their financial identity, privacy and personal data is safeguarded around the clock and credit quickly repaired if ever needed.”

Why identity theft protection is worth the investment

Although an identity theft protection service like Bitdefender’s new offering may seem like an expensive addition to your budget when your wallet is already stretched thin, it could be a tremendous help if you ever have your identity stolen.

According to Experian, it can take anywhere from a few days to up to several years to recover your identity once it’s been stolen. During that time though, you’ll likely be unable to take out a new loan or mortgage, get a new credit card or even start a new job as many employers check your credit history as part of their background check process. Likewise, you could end up owing the IRS money if a cybercriminal applies for a job using your social security number and doesn’t pay their taxes.

Identity theft remains a significant risk for consumers and in 2021 alone, US consumers lost almost $6 billion to fraud according to the FTC. Additionally, a recent Bitdefender survey of more than 10,000 consumers found that many practice high-risk behaviors when it comes to data protection and their digital identities including using a single password across all of their online accounts (50%), regularly sharing their personal information (43%), email address and birthdate (40%) and home address (29%).

While identity theft protection can help you regain your identity, using a password manager to create and store unique passwords for all of your online accounts can help prevent them from being taken over in the first place. There are also steps you can take if your Social Security number gets stolen.

The FBI yesterday (March 7) issued a public service announcement warning Americans about scams in which crooks pretend to be government or law-enforcement officials and try to scare victims into coughing up cash or providing valuable personal information.

Such scams have been going on for years. They usually involve a phone call or email in which someone claiming to be from the IRS, FBI or another agency tells you that you're about to be arrested or punished for some imaginary infraction — and that you need to pay a fine or provide information such as your Social Security number.

It's not clear why the FBI is issuing this warning now, other than there are "ongoing widespread fraud schemes" of this nature. However, such scams are now as common as they've ever been.

How government-impersonation scams work

"Scammers will use an urgent and aggressive tone, refusing to speak to or leave a message with anyone other than their targeted victim; and will urge victims not to tell anyone else, including family, friends, or financial institutions, about what is occurring," the FBI warned.

"Payment is demanded in various forms, with the most prevalent being prepaid cards, wire transfers, and cash, sent by mail or inserted into cryptocurrency ATMs. Victims are asked to read prepaid card numbers over the phone or text a picture of the card."

If you receive one of these calls, the FBI said, you may be told that you have failed to report for jury duty, that you have missed a court date, that there is a warrant out for your arrest or that you owe taxes. In these cases, you're often asked to pay a fine using the methods above.

Another variant involves being told that someone has committed a crime using your name — and that to clear yourself, you have to tell the caller your full name, address, date of birth and Social Security number. 

Those just happen to be the four factors with which you can steal someone's identity. This scam also isn't terribly different from the "Social Security" scam in which a caller tells you your identity has been stolen and to verify your identity over the phone.

The FBI also warned that scammers might send text messages to mobile phones notifying phone users that their passports or drivers' licenses need to be renewed. 

The FBI didn't provide further details on that, but it's likely that the text messages would include links that take you to phishing pages mocked up to look like official forms in which you'll be asked to provide your name, date of birth, address, Social Security number and so on.

Government agencies won't call you

Overall, you need to remember that the government notifies citizens by snail mail or in person. 

If it's a routine matter, you will get a letter notifying you that you have missed jury duty, need to appear in court or owe back taxes. You may or may not get a letter notifying you that your driver's license needs to be renewed, depending on the state. 

If it's a more urgent matter, law enforcement officers will come visit you at your home or workplace in a manner friendly or otherwise. 

As the FBI says in the advisory, "NO legitimate law enforcement or government official will request payment via prepaid cards or cryptocurrency ATM. Never give personally identifying information to anyone without verifying the person is who they say they are."

What to do if you fall for a government impersonator

If you end up falling for one of these scams, your recovery options are unfortunately limited. 

Your chances of getting money back depends how you paid the "fine." Regular credit cards give you the best chance; prepaid cards and gift cards are more like cash, but call the card issuer anyway.

As for cryptocurrency, wire transfers to overseas banks or cash, those are usually gone the moment they leave your hands. Nevertheless, you should still file a report with the FBI's own Internet Crime Complaint Center.

If you provided personal information such as your date of birth or Social Security number, you'll need to get proactive. 

First, follow our instructions on how to set up a fraud alert with the Big Three credit-reporting agencies. Second, if you're not about to buy a new house or new car, consider instituting credit freezes with the Big Three. Last, consider paying for one of the best identity-theft-protection services, which will alert to you to identity theft and help you recover from it.

By focusing on credit monitoring, Identity IQ Secure Max provides the scores and reports from the top credit bureaus but falls short on things like investment account monitoring or checking on payday loans made in your name. The service’s credit simulators are a big help but none of Identity IQ plans have two factor authentication. The pay-off is for families because the top plan includes ID protection for children, making it the one to get for those with a large brood. 

Our IdentityIQ Secure Max review will help you decide if this the best identity theft protection service for you or if you would be better off with a service that focuses more heavily on identity theft prevention as opposed to credit monitoring.

IdentityIQ Secure Max review: Costs and what’s covered

With three plans to choose from, IdentityIQ has a trial with a twist. You pay $1 to get started and then the full price comes into effect a week later to provide a taste of the service.

The big change from last year is the inclusion of an annual plan discount. With it, users save 15% if they sign up for a year at a time. For example, the already inexpensive $10 a month Secure Plus plan is a genuine bargain at $101.90 a year. It pairs single bureau credit scores and monitoring with $1 million in identity insurance to get your digital life back. The company not only keeps an eye on your Social Security number but specializes in thwarting synthetic identity theft where several factors are combined to reveal your identity.

The Secure Pro plan ups the credit bureau coverage and scores to all three major agencies. It adds full reports every six months. The $20 a month or $203.90 annual service adds alerts to crimes committed in your name as well as credit score change alerts.

IdentityIQ’s flagship plan is the $30 a month Secure Max subscription that I signed up for. It costs $305.90 yearly. Secure Max includes monthly credit reports from the top three bureaus and an extra $25,000 in insurance for other members of the family. The included credit score simulator can help solve what-if questions in terms of taking out new loans or paying off credit card balances. 

All of IdentityIQ plans can be bolstered with the equivalent of Bitdefender Total Security for just a few dollars a month. It adds $2 a month for the Secure Pro and Plus plans or $3 for Secure Max. On its own, the software costs $160 a year.

A bonus for families is the ability to cover up to three children who are under 24 years old and live with the family. This service includes Social Security number monitoring and alerts for them.

The most recent report from the Better Business Bureau rates IdentityIQ’s parent company, Identity Intelligence Group with a B+ grade. That’s a step down from the top ratings, but more than adequate. 

IdentityIQ Secure Max review: How we tested

In the late summer of 2022, I set up IdentityIQ’s Secure Max plan, paid for it myself and was reimbursed by Tom’s Guide. Over the next three months, I used IdentityIQ with the service’s web interface using a variety of systems as well as with the mobile app and my Samsung Galaxy S20 phone. I canceled the service after three months. 

IdentityIQ Secure Max review: Credit scores and monitoring

The Secure Max subscription delivers VantageScore 3.0 scores that are a good substitute for creditworthiness. If you want FICO scores, the company’s MyScoreIQ provides them with a variety of plans.

It also monitored my bank and credit card accounts looking for potentially fraudulent activity. My favorite is the overdraft alert that will, hopefully, get me to move extra money into the account to avoid a penalty. However, it isn’t complete protection because the Secure Max service wasn’t able to look at my retirement investments or my PayPal account for potential illegal activity. 

None of the IdentityIQ products can freeze your credit with a click or tap. Instead, you would need to talk to one of the company’s agents to do so. 

The Secure Max plan includes monthly access to the full credit reports. Others provide this valuable anti-fraud material on a quarterly or yearly basis or not at all. If you’re anxious about a particular alert or recent scam attempt, a $10 instant report is a click away.

In addition to tracking national and international crime databases, IDIQ monitors court records for your name in association with a criminal or bankruptcy proceeding. However, it lacks access to payday loan information but can search for your vital data on the dark web. The service is also unable to reach into data brokers’ databases for your personal information. Closer to home, Secure Max keeps an eye on the postal service for an address change in your name but can’t alert you to a title change for your property.  

IdentityIQ has made an effort to identify and stop synthetic identity theft, where several small pieces of data (like incomplete Social Security numbers and addresses) are combined to reveal your data and open you to fraud or identity theft. Others ignore this rapidly growing aspect of ID theft.

IdentityIQ Secure Max review: Insurance and services

Underwritten by AIG, IdentityIQ’s insurance component covers the result of any identity theft or fraud. Regardless of which IdentityIQ plan you get, they all top out at $1 million, half what Bitdefender Ultimate Plus provides, although the Secure Max plan I used added $25,000 for extra family members. 

It covers the gamut of identity theft responses to help you become whole again, from lawyers to consultants to investigators to accountants. The response can include granting them a Limited Power of Attorney for these activities so that you can concentrate on getting the rest of your life together.

The plan includes getting new documents, like a driver’s license, passport and Social Security card (and new number). There’s up to $1,500 a week for five weeks to cover lost wages if you need to miss work. It can also help if your wallet (or purse) has been lost or stolen.  

IdentityIQ Secure Max review: Notifications and alerts

The alerts that IdentityIQ provide range from an overdraft warning for your checking account to signs of credit card fraud to if your personal information has been involved in a recent data breach. Unfortunately, there’s no sex offender alert that shows the offender’s location; others provide this. 

Available via the company’s web interface or the mobile app, IdentityIQ’s alerts show up prominently. If you set it up when registering, IdentityIQ’s servers will send alerts via text messaging. Over my three months subscribed to the service, I received nine alerts. They were mostly about dark web breaches.

IdentityIQ Secure Max review: Setup

One of the easiest and quickest ways to protect your credit and identity, IdentityIQ took all of 7 minutes to create an account and start protecting my persona. It started with picking the Secure Max plan and clicking “Get Protected Now”. 

After creating an account and password, I checked the box that showed that I’ve lived at my current address for at least six months. Then, I entered my Social Security number, date of birth and phone number. A recent addition is the ability to have alerts sent via SMS text messaging, which I signed up for.

I paid with a credit card; IdentityIQ doesn’t take PayPal. After three challenge questions about car loans, mortgages and a previous address, I was in. I received a welcome email along with the plan’s major attributes and a dark web alert. The dashboard showed my three credit scores and a summary. My first log-in required my Social Security number’s last four digits.

Happily, the company has stopped sending ads and come-ons to clients that were annoying in the past. Everything they have on you is saved in encrypted form on IdentityIQ’s servers. Unlike some of its competitors, the company retains some of the metadata about you and your account in case you have an identity problem in the future.

The company uses the phone as its primary tech support portal and staffs its help desk from 7 a.m. to 7p.m. CT Monday through Friday and 8:30 a.m. to 5 p.m. on Saturdays. In the event of an emergency, they’re available 24/7. There is no dedicated customer-support section on the IdentityIQ web site. I did like the rundown on what’s in a credit report and the company’s FAQs though.

IdentityIQ Secure Max review: Interface and utilities

With a browser-based approach to notebook, desktop and mobile access, with IdentityIQ there’s nothing to load on your phone and both interfaces look alike. On the other hand, it requires some patience to use the service on mobile.

While the company doesn’t employ two factor authentication (2FA) to prove that you actually are you at log in, it does ask for the last four digits of your social security number.

The Dashboard has a lot to offer but can appear crowded because it tries to do a lot. Like Bitdefender Ultimate Plus, it’s a long strip that requires zooming out to 25%. Setting it to 50% was comfortable for me to take in two of its six elements, like the credit scores and summary, at a time.

Up front are the Big Three credit scores and access to reports a level below the surface. In addition to showing the total number of accounts, the interface has a history of dings to your credit by each bureau and payment details for credit cards and loans.

At any time, I could buy an instant report to supplement and update this data. It costs $10 for a single agency or an economical $19 for all three.

In addition to a side menu for major alerts (Credit Monitoring, Identity Monitoring and Score Monitoring), the interface has tabs for the service’s major functions, like Reports & Scores (the three bureau output), Monitoring (setting up and modifying notifications) and Plan Ahead (using the lost wallet, junk mail and insurance features). At any time, tap the IdentityIQ logo to go back to the dashboard.

Most intriguing of all is IDIQ’s Secure Max Credit Simulator. Is it better to pay off your credit card debt or pile on more? All is revealed. There’s the choice among improving credit scores, handling payments better, opening a new account and how public records affect the scores.

The service provides articles on preventing identity theft and improving credit scores as well as more general topics. Most are fairly recent, but a few are two years old. My favorite was about criminals using a change of address form to scam loans and credit cards.

IdentityIQ on a phone is done through a browser as well, and it looks surprisingly good. The Dashboard’s layout is similar but set up as a long strip with the Alerts & Notifications at the top.

Below are the credit scores, followed by access to credit reports and a nice credit summary of open accounts, negative ratings, recent inquiries and a cool debt-to-income ratio.

IdentityIQ Secure Max review: Cancellation

There’s no way to cancel IdentityIQ’s service on the website or by email. I called their tech support line and had to wait several minutes before talking to a person. When I did, the operator recited all the plans benefits and tried out a special price that reduced the plan to $10 a month. Finally, after 10 minutes, the plan was canceled with a confirmation email received.

IdentityIQ Secure Max review: Bottom line

With the potential to inexpensively cover an entire family, IdentityIQ Secure Max includes protection for up to three children, something others charge for. The service starts with monthly three-bureau reports and scores but adds credit simulators and monitoring of bank accounts. Too bad it lacks the ability to keep any eye on investments, payday loan companies and two-factor authentication. Still, IdentityIQ provides a lot for the money for security-minded families. 

The very serious server-software flaw named "Log4Shell" that affected many Minecraft players at the end of last week has, as feared, come to affect the entire internet. In terms of potential impact, it's one of the most severe computer-security vulnerabilities the world has ever seen.

"I cannot overstate the seriousness of this threat," researcher Lotem Finkelstein of Israeli security firm Check Point told ZDNet. 

His firm has seen more than 850,000 attempted attacks on servers since a working exploit for the vulnerability was posted online Thursday (Dec. 9). Antivirus firm ESET said the U.S., U.K., Turkey, Germany and the Netherlands were seeing the most attacks.

The good news: This flaw doesn't directly affect the average computer user, except for Minecraft players using the Java Edition and other PC users who for one reason or other are running a Java environment. 

The Java software in question has been fully patched as of Dec. 13 — an earlier version that mitigated the flaw went up Dec. 8 — but it's useful only if you actively run a web server. (Minecraft users need to just update their client software.)

The bad news: Hundreds of thousands, perhaps millions, of web servers are affected and can be hacked with very little effort. Criminals are already using the flaw to install coin-mining, botnet and backdoor malware on servers, report Microsoft and the Swiss government. 

The flaw has been given a 10 out of 10 on the severity scale by the Apache Software Foundation, which maintains the software.

"There is an extremely high chance, almost certain, that every person interacts with some software or technology that has this vulnerability tucked away somewhere," Huntress Labs researcher John Hammond told Dark Reading.

Servers run by Amazon, Apple, Baidu, LinkedIn, QQ, Steam, Tencent, Tesla and Twitter are or until recently were vulnerable to some extent, although internal safeguards may prevent further exploitation in each case.  

(There are reports that Apple has patched its servers, but we couldn't find the original source for those reports, and Apple has not yet responded to our request for confirmation.)

We can expect to see a lot of data breaches, ransomware attacks, credit-card thefts and perhaps even "drive-by downloads" resulting from this flaw. If anything is stored on a web server, it's at risk.

Bitdefender reported Dec. 13 that it had observed online criminals using the Log4Shell flaw to install ransomware and remote-access Trojans on Windows PC, but it wasn't clear whether the affected PCs had Java previously installed or not. We've reached out to Bitdefender for clarification.

Log4Shell: 'Unbelievably simple' attack

"The exploit is actually unbelievably simple — which makes it very, very scary at the same time," Bogdan Zdrnja of the non-profit SANS Institute told Vice Motherboard. 

All that an attacker needs to do is to send a web server a small string of carefully crafted text. The text can be a forum post, a login attempt, a header string in a web page or any other kind of data that might ordinarily be "logged" by a server along with hundreds of thousands of daily log entries. 

The attacker's text will trick the targeted server into disclosing secret information, or even into sending a request for files to another server — such as one that the attacker controls. In response, the attacker's server can send a command to download and execute malware to the targeted server — which the targeted server will then carry out.

One jokester even put the exploit code into the name of his iPhone and got an Apple server to respond.

Jen Easterly, director of the U.S. federal government's Cybersecurity and Infrastructure Security Agency (CISA) called this flaw a "severe risk" and "an urgent challenge to network defenders" in an official advisory. 

CyberScoop reported that in a call with tech-company executives Monday, Easterly said the vulnerability "is one of the most serious I've seen in my entire career, if not the most serious."

What can you to do defend yourself from Log4Shell?

As an end user, there's not much you can do to fix the affected servers unless you happen to have Java installed. (Security experts recommended that PC and Mac users disable Java years ago, and there are few reasons to use it nowadays). 

However, because online criminals will exploit this flaw any way they can, you need to prepare yourself for the worst. 

Expect that your personal information will be disclosed in data breaches resulting from this flaw, and that you will be at greater risk of identity theft. Expect that some of your passwords will be stolen and some of your online accounts hijacked. 

Expect that your favorite online retail websites will be hacked to steal your credit-card number, a likelihood compounded by the holiday shopping season. Expect that some websites you frequently visit will be corrupted to send you malware. 

In other words, the risks that you already face online will be dialed up to the maximum. Here's what you need to do.

Sign up with and use a password manager. There's no excuse not to do this, as many of the best password managers are partly or totally free. Use the password manager to make sure all your passwords are strong and unique. You want to do this today, not tomorrow, so that if one of your account passwords is compromised, only one account will be in danger, not all of them.

Set up a free credit freeze to limit the damage from potential identity theft. You may also want to consider one of the best identity theft protection services, but the credit freeze is the best preventive measure you can take.

Monitor your credit-card accounts for the next few weeks. If you see anything that looks wrong, call the phone number on the back of the card and tell the bank that issued the card right away. 

Monitor your credit reports for the next few months. Until April 2020, U.S. residents are allowed to get one free credit report from each of the three big credit bureaus (Equifax, Experian and TransUnion) every week.

Install some of the best antivirus software. Windows 10 and 11 already have Microsoft Defender Antivirus built in, and it's very good, but it doesn't protect you from web-based threats coming in through non-Microsoft browsers such as Google Chrome or Mozilla Firefox. Microsoft Defender also doesn't help much with Android, Mac or iOS.

To be fair, all of these recommendations are things that you really ought to be doing anyway. But the fact that half the internet is in immediate danger of being horribly hacked makes these safeguards crucially important.

Log4Shell flaw explained

Very briefly, the Log4Shell flaw, catalogued as CVE-2021-44228, lies in a piece of open-source software called Log4j, a simple logging program for Java-based applications that's maintained by unpaid volunteers for the Apache Foundation. 

This incident has renewed calls for the huge corporations that use open-source code to kick back some cash to the developers, who work on these tools in their spare time.

Logging programs are meant to simply record events, not actively execute code. But Log4j does a poor job of "sanitizing" the data that it takes in. As such, attackers can sneak in malicious code as described above, then get the Java-based server to run the code. 

Because Java is a cross-platform environment designed to "live" on many kinds of operating systems, servers running Windows, Linux, Unix or even macOS are equally vulnerable.

Speculation that Java libraries such as Log4j might be vulnerable to attack dates back to a 2016 Black Hat presentation. But this particular vulnerability was reported Nov. 24 to the Apache Foundation by researchers with Chinese internet giant Alibaba, and a fix was quietly developed over the following two weeks and released Dec. 8. 

Mass attacks using the flaw began as soon as the proof-of-concept code was posted early the next morning. Internet-security firms Cloudflare and Cisco Talos checked their logs, however, and found evidence of possible exploit attempts as far back as Dec. 1. 

Those "attempts" may have been the result of defenders pinging servers to see how widespread the vulnerability was. But it could also be that the flaw was privately leaked to state-sponsored security services, as a different flaw may have been earlier this year.

Updated with additional information. This story was originally posted Dec. 13.

It's holiday shopping time, which means scammers and identity thieves are waiting to snare people eager to find deals or hard-to-find items online. Fortunately for us, there are tried-and-true ways to avoid being taken in by online holiday-shopping scams.

"Scammers use the holiday season to swindle unsuspecting victims through fraudulent emails and other schemes," Bitdefender's Alina Bizga warned in a recent company blog post that detailed the rise in shopping-related phishing emails as the holidays approach. "There's no shortage of fake deals and promotions for keen shoppers to fall for."

Bitdefender found that holiday-shopping phishing emails predominantly targeted the United States, and the email messages' subject lines promised great deals on top-brand sunglasses like Ray-Ban and Oakley as well as Walmart and Amazon exclusives. 

Meanwhile, Kaspersky  saw shopping-related phishing emails more than double from September to October as the holiday shopping season approached, with Amazon and eBay leading the list of spoofed brands.

The FBI warned recently  that hard-to-find gaming consoles, such as the PS5, were being used as lures by online criminals as people try to hunt down PS5 restocks. But people taken in by such scams may find that the promised items never arrive, that their credit-card numbers get used by crooks, or that their personal information ends up being stolen. 

"Victims may receive nothing except a compromised identity or fraudulent card charges," said the bureau, warning shoppers to beware "untrusted websites and ads promoting unrealistic discounts and bargains."

Even the IRS  is joining the chorus of doom, putting up a blog post warning of end-of-year shopping scams and identity theft. 

"We urge people to be extra careful with their personal and financial information during this period while shopping online or getting suspicious emails or text," said IRS Commissioner Chuck Rettig. 

Cute puppies, free iPhones and dream getaways

One category that seems to attract a lot of online swindlers, according to the FBI, is pets. People looking for just the right puppy or kitten for the holidays may be extra-ripe for the taking, as there's so much emotion and expectation bound up in the purchase. It's easy to overlook red flags when you've fallen in love with a picture of an adorable fur-baby.

"Criminals will use legitimate website photos to promise the non-existent pet to multiple buyers," said the FBI, but the price may quickly ramp up due to surprise shipping fees, vaccination expenses or even sales tax. "If purchasing a pet online, consider meeting the animal and owner via video chat before buying to reduce the chances of being scammed."

Scams in which the paid-for item never shows up are called non-delivery scams by the experts. But there are also delivery scams, which is what happens when an item you didn't buy suddenly seems to be ready for you.

Security firm Proofpoint  detailed such scams in a recent blog post, explaining how crooks will send text messages to random numbers saying that a package is about to be or has been delivered. Because these combine SMS messages with phishing, they're called "smishing" attacks.

The item that's being delivered is often something expensive and desirable, such as an iPhone 13. Even if you didn't order the item, or don't even have the same name as the person being messaged, you might be tempted to collect the item. That's how the crooks use your own darker impulses against you.

But there's always a catch. In order to get the prized item into your hands, you've got to go to a website and fill out some personal information, pay a small fee, or both. Sometimes the website will even try to infect your phone with malware, just because.

These delivery scams don't just happen around the holidays, but they sure seem to ramp up toward the end of the year. Finland just saw a massive wave of such attacks involving the FluBot Android malware, which gets installed via bogus delivery notifications and then spreads to more phones by sending out smishing messages to your entire address book.

Another big lure is a scam involving holiday travel. Bitdefender has seen a rise in phishing emails promising great deals on flights and hotels. It's easy to be tempted by the promise of cheap hotel rooms in a destination you were planning to visit anyway, or by amazing ticket prices to a fabulous destination you thought you couldn't afford to travel to.

How to avoid holiday shopping scams

So how can you avoid becoming a victim of one of these sinister seasonal shopping scams? As we outlined in our previous guides for safe shopping on Black Friday and Cyber Monday, common sense should be your guide.

"If the deal sounds too good to be true, chances are it is a scam," the FBI said. That random online store you've never heard of almost certainly doesn't have a truckload of PS5s, and doesn't it seem funny that it wants you to pay with gift cards instead of a regular credit card?

Here's what else you need to do and watch out for. These are not ranked in order of importance, because they're all important.

• Don't click on links in email messages or social-media posts that promise fantastic savings. Those links could take you God-knows-where, even if the message or post looks legit. Instead, go to the retailer's website in your web browser and then look for the deal there. 
• Don't click on search-engine results for the best deal on whatever you're shopping for. Crooks can "poison" search-engine algorithms to make sure their bogus links rise to the top. Again, go to the retailer's site and search for the deal from there. 
• Don't click on deal links that are texted to your phone.
• Don't do business with a retailer that uses a free email service, like Gmail or Yahoo or Outlook.com. 
• Don't trust third-party transactions, in which you're buying something from one person or company but are being asked to pay a different person or company.
• Stick to familiar, well-known retailers when shopping online. They don't all have to be Amazon, but you don't want to give your credit-card number to Crazy Ivan's House of Electronics just to save $25 on a gaming controller.
• Use only credit cards while shopping online. Debit cards tied directly to your bank account offer far less protection against fraudulent charges, and crooks can infect retail web servers with malware designed to steal card numbers. The FBI goes a step further and says you should designate one credit card for online purchases only.
• Don't pay with wire transfers, gift cards, cryptocurrency or cash. These offer no protection at all, and if anyone asks you pay for items using one of those methods, that's a big red flag. 
• Carefully check your credit-card statements every few days during the holiday shopping season. Because there's a lot of spending happening, you might miss a fraudulent transaction nestled in among all the real ones.
• Make sure there's a padlock icon next to the site's web address in the browser address bar when you're using a desktop or laptop. This shows there's a secure, encrypted connection. The site could still be run by crooks, but you should never send financial or personal information over a connection that isn't secure.
• Use a retailer's own app rather than your browser when shopping on your smartphone or tablet. It's hard to "spoof" an entire mobile app, unless you happened to download that app from outside the Google Play Store or Apple App Store.
• Use a secure Wi-Fi network to get online if you're away from home or work. Don't use a totally open Wi-Fi network such as you might find in a cafe, park or restaurant. When in doubt, fire up one of the best VPN services to make sure your local connection is secure.
• Check the retailer's website address, even if there's a padlock. Crooks are very good at mimicking legitimate retail websites, so make sure the address isn't something like "amazzon.com", "wa1mart.com" or "bestbuy.su".
• Don't let websites save your credit-card information. You'll have to type it in again next time you visit (unless you're using one of the best password managers), but your credit-card data won't be stolen when the site suffers a data breach. Also, don't let your web browser store your credit-card info, as browsers are far too easy to hack.
• Don't create an account on a retail website just so you can shop there. Use the "continue as guest" option instead, if available. There's no need to increase your risk of being caught up in a data breach. If you do have to create an account, as you do with Amazon, then use a password manager to create and remember a strong, unique password.
• Make sure your PC, Mac, smartphone or tablet is fully updated with the latest version of the operating system, and use the best antivirus software appropriate to Windows, Mac or Android.

"Taking a few simple steps can keep people from becoming victims of identity theft and protect their sensitive personal information needed for tax returns and refunds," said the IRS' Rettig.

Never ones to pass up an opportunity, phishing scammers are now using the media coverage of the new Omicron variant of the SARS-CoV-2 virus, which causes COVID-19, to steal people's personal information and commit identity theft.

It began last week when British consumer-review website Which? (the question mark is intended) got several phishing emails forwarded from readers. All the emails claimed to come from the National Health Service (NHS), England's public-health authority, and offered to send readers an Omicron-variant home-testing kit. 

The emails added that every resident of the England needed to take such a test or be required to self-isolate.

"People who do not consent or cannot agree to a COVID-19 test and refuse to undergo a [test] swab must be isolated," the email said.

The email provided a link or button for readers to click on, which took anyone foolish enough to do so to a fake NHS page that, as Which? put it, "asks for your full name, date of birth, address, mobile [number], and email address — more than enough to attempt identity fraud." 

As an option, it also asked you to provide your mother's maiden name as the answer to a "security question." There was also a "delivery fee" of £1.24 (about $1.65 U.S.) to get the supposed Omicron test to you.

Coming to America

Today (Dec. 6), Bitdefender reported that it had seen the same scam email repurposed to target U.S. residents, with the purported sender being the federal Department of Health and Human Services rather than the NHS. 

The U.S. version is a bit different. Confusingly, it urges you to "book your slot today" for an Omicron-variant test, which presumably would be done at a clinic or pharmacy, but then later offers to send you a home-test kit.

Instead of providing a link to a website, the U.S. version just provides a phone number to call.

"Individuals who are duped into calling the number will most likely end up speaking directly to the scammers, who plan to trick them into handing over personal information including their credit-card details," Bitdefender's Alina Bîzga wrote in a company blog post.

Needless to say, don't believe any of these emails, or similar instant messages, text messages or social-media posts, if they come your way. There's no COVID-19 testing mandate for the general public in either country, and the tests in-use can detect the Omicron variant along with other forms of the virus. 

What to do if you fall for the Omicron phishing scam

If you do happen to fall for one of these scams, then you're at serious risk of identity theft. U.S. residents should set up a free credit freeze with the Big Three credit-reporting agencies, Equifax, Experian and TransUnion, as well as file fraud alerts with all three bureaus. (You need to contact only one bureau about the fraud alert, and that bureau will notify the other two.) 

Take advantage of the greater availability of free credit reports, because at least until April 2022, you can get a free report from Equifax, Experian or TransUnion every week at annualcreditreport.com. You'll also want to consider one of the best identity theft protection services.

U.S. residents should also file a fraud report with the Federal Trade Commission at https://reportfraud.ftc.gov/ just so the agency can keep track of the scams. And if you happen to give one of these scammers your credit-card number, contact the bank that issued the card right away and notify them that there might be fraudulent charges on the way. You may have to be issued a new card.

If you're a U.S. resident and someone does end up using your personal information to commit fraud, then you may need to file a police report. That's the first legal step in reclaiming your identity and making sure you won't be held liable for fraud committed by someone pretending to be you. We have more information in our guide about what to do if your identity is stolen. 

In the U.K., you should apply for Protective Registration  with the fraud-prevention service Cifas. Protective Registration costs £25 and places an alert with your file in the National Fraud Database, which lasts for two years. You can also get free credit reports from each credit bureau's UK website: Experian, Equifax  and TransUnion.

And as in the U.S., you also should contact your credit card's bank if you gave the number to the scammers.

Updated Aug. 27 with note from T-Mobile's CEO.

T-Mobile yesterday (Aug. 17) posted an update on its most recent data breach. While the company seems to be trying to reassure people, it's hard to put a positive spin on this news, which is about as bad as it gets.

T-Mobile said that only about 49 million current, former and prospective T-Mobile customers had their personal account information stolen — not 100 million as a hacker claimed on an internet forum this past weekend.

• Identity theft victim? Here's 6 things you need to do
• MacBook Pro 2021 with mini-LED has me excited for the future of laptops
• Plus: T-Mobile data-breach website lets anyone sign up for identity-theft protection

Regardless of how many millions of people had their T-Mobile data hacked, the upshot is this: If you've ever applied for a T-Mobile postpaid account, you now have to assume that your name, address, date of birth and Social Security number have been fully compromised. 

You have to assume that anyone could use that information to open accounts in your name, sell your Social Security number, get an ID card in your name or even use your name while they're being arrested.

What you need to do about T-Mobile's data breach

Here's what you need to do if you have ever had or have ever applied for a T-Mobile postpaid account. (We'll get to T-Mobile prepaid customers in a minute.)

• Take T-Mobile up on its offer of two years of McAfee ID Theft Protection Service.
• Put a fraud alert on your credit files with Equifax, Experian and TransUnion. (Here's how.)
• Consider instituting a credit freeze with the Big Three credit-reporting agencies. (Here's how.)
• If you have a T-Mobile account, change your T-Mobile account PIN and password.
• If you have a T-Mobile account, take the offer to set up Account Takeover Protection.

Lastly — and we don't say this flippantly — consider dropping T-Mobile and switching to a wireless carrier that does a decent job of protecting your personal information. This is the fourth or fifth major T-Mobile data breach in the past three years, and if this company's track record is any indication, it won't be the last.

All you need to steal someone's identity

In its post yesterday (Aug. 17), T-Mobile said that "we were able to verify that a subset of T-Mobile data had been accessed by unauthorized individuals."

Approximately 7.8 million current T-Mobile postpaid customers, and "just over 40 million" former postpaid customers, as well as prospective customers who had applied for postpaid accounts, had their full names, dates of birth, Social Security numbers and driver's-license or ID numbers compromised.

The bright side — if there is one — is that there is "no indication that the data contained in the stolen files included any customer financial information, credit card information, debit or other payment information." 

Nor were any "phone numbers, account numbers, PINs [or] passwords" compromised for these 48 million people, although T-Mobile is recommending these people reset their PINs anyway.

That's nice, but the theft of Social Security numbers is a lot more serious. It's not hard to cancel credit cards or reset PINs, while your Social Security number stays with you for life.

T-Mobile prepaid accounts also hit, but not as badly

However, that's not all. The company said "approximately 850,000" people with "active" prepaid T-Mobile accounts had their "customer names, phone numbers and account PINs" compromised. T-Mobile said it has reset all those PINs already.

These people did not have their Social Security numbers exposed, T-Mobile said. Nor does it mention dates of birth or home addresses, two things that people with prepaid accounts may not have to provide when setting up an account.

If you have a T-Mobile prepaid account, you should reset your PIN again, as well as your account password, but you're probably good regarding potential identity theft. 

The company added that "no Metro by T-Mobile, former Sprint prepaid, or Boost customers had their names or PINs exposed." 

But it didn't say anything about current or former Sprint postpaid, or current Sprint prepaid, customers. It's possible that more bad news might come out of this already awful data breach.

Update: T-Mobile CEO posts apology

On Aug. 27, T-Mobile CEO Mike Sievert put up a blog post apologizing for the data breach (which affects 54 million people, not the 48 million of earlier) and announcing that the company had entered into "long-term partnerships" with enterprise-security firm Mandiant and global accounting firm KPMG to prevent future security mishaps.

"I want to say we are truly sorry," Sievert wrote. "We didn’t live up to the expectations we have for ourselves to protect our customers."

Sievert said that nearly every current T-Mobile customer whose personal information was compromised in the breach has been notified, adding that "we are also now working diligently to notify former and prospective customers."

• More: OnePlus Nord 2 vs. OnePlus Nord: what's new?

A hacker who claims to be behind last week's T-Mobile data breach that compromised 54 million people's personal data told The Wall Street Journal in a story published today (Aug. 26) that the company's "security is awful." 

John Binns, a 21-year-old American living in Turkey, his mother's homeland, told the newspaper that he found an unprotected T-Mobile router online in July, then used that to pivot on Aug. 4 into more than 100 servers containing personal data of current and former customers at a T-Mobile data center in central Washington state.

• T-Mobile breach fallout — it's time to decide who deserves your business
• The best identity theft protection services
• Plus: How to create a 'kill switch' in Windows

"I was panicking because I had access to something big," Binns told the Journal in a conversation on the Telegram encrypted-messaging platform.

The Journal said it verified Binns' identity with a series of personal questions, and said the Telegram account he used had provided details of the T-Mobile hack before they became publicly known. 

Binns would not tell the Journal whether he had sold any of the data he stole, or if he was paid to attack T-Mobile. 

This is T-Mobile's fifth or sixth data breach in the past three years, depending who's counting. With such a dismal track record, you might consider taking your business elsewhere if you value your private data.

At least 54 million people affected

The breach came to light Aug. 15 after a hacker offered to sell part of the data, pertaining to 30 million T-Mobile customers, for six bitcoin (about $280,000) in a cybercriminal forum. The Journal implied that the seller may not have been Binns.

More than 54 million current, former and even prospective T-Mobile customers were affected, most of whom had their full names, dates of birth, Social Security numbers and current or former addresses compromised. 

Those four bits of personal information are often all that's required to open an account in someone else's name, and the affected individuals are at serious risk of identity theft.

'Generating noise'

Binns told the Journal that he attacked T-Mobile with the purpose of "generating noise," but added that he had been persecuted by U.S. government agents while he was in Germany. Binns sued the CIA, the FBI and other federal agencies last year, the Journal said, and the case is still active.

When the data breach was initially revealed, the apparent hacker or hackers told an Israeli security researcher that the attack "was done to retaliate against the US for the kidnapping and torture of John Erin Binns (CIA Raven-1) in Germany by CIA and Turkish intelligence agents in 2019," according to Bleeping Computer. 

The Journal said Binns appeared to be one of many people involved in the Mirai botnet attack that knocked out internet access for most of the U.S. East Coast on Oct. 21, 2016.

T-Mobile is offering anyone affected by the breach two years of free identity-theft protection and credit monitoring. We recommend that any who's ever applied for a T-Mobile account take the company up on the offer, and also freeze their credit files if possible.

This week, we saw a huge data breach at U.S. wireless carrier T-Mobile that exposed the names, Social Security numbers and dates of birth of some 48 million people. It's T-Mobile's fifth, possibly sixth, data breach in the past three years.

We also saw that many widely used U.S. food- and grocery-delivery apps take only minimal steps toward protecting user accounts and credit-card numbers. The result is that it's maddeningly easy to hijack an account with some of the best-known delivery apps.

• What to do after a data breach
• The best identity theft protection services
• Plus: T-Mobile data-breach website lets anyone sign up for ID-theft protection

It's time for consumers to act. If you want to keep your personal and financial data protected, then you should stop doing business with companies that don't adequately protect your personal data. Switch to companies that do a better job of it.

How does a company respond to a breach?

To be clear, I'm not advocating dropping every company that suffers a data breach. Breaches happen, unfortunately, even to companies that take personal-data security very seriously.

What you need to watch instead is how a company responds to a data breach. Does it tighten up its security? Does it put new safeguards in place? If so, you can assume the company is making good-faith efforts to try to make sure it doesn't suffer any more breaches.

Red flags arise, however, when a single company has a run of data breaches. T-Mobile has a horrible record of this. It gets breached again and again and again. It's hard to tell if the company even cares.

In the most recent T-Mobile breach, it appears that the company didn't properly encrypt the Social Security numbers of tens of millions of people who applied for T-Mobile accounts. All those people are now at severe risk of identity theft because the T-Mobile breach also compromised their names, addresses and dates of birth.

So are Verizon and AT&T any better? Yes. Verizon had a data leak in 2017 when some data was exposed on a third-party server, but that's the last incident that I know of. 

Verizon also publishes the well-regarded annual Data Breach Incident Report, an authoritative analysis of known cybersecurity incidents in the previous year.

As I write this, there are reports that a known group of hackers has stolen data pertaining to 70 million AT&T accounts. The company has taken a look at the data and said it didn't come from its servers. 

We'll have to see how that plays out, but we can also tell you that we haven't reported on any other AT&T data breaches in many years.

No 2FA, no sale

Meanwhile, what about food-delivery apps? Are they really that bad? 

Let's put it this way: It doesn't take a lot of effort for a company to offer two-factor authentication (2FA) to its customers to better protect their accounts. 

2FA is a pretty commonplace feature that makes sure anyone logging into an account from a new device or location, even with the correct username or password, has to input an extra temporary code that's sent to or generated on the legitimate user's phone.

But among seven different food- and grocery-delivery apps that we signed up with, only UberEats and its subsidiary Postmates offered 2FA as an option. The rest would let anyone sign in from anywhere as long as they had a registered user's username and password. And hundreds of millions of stolen usernames and passwords are floating around the internet, ripe for the taking.

So what can you do? You can bother those companies that don't implement 2FA by going to the 2FA Directory and clicking the links to send them messages via Twitter, Facebook or email. Or you can vote with your wallets and use the same directory to switch to those companies that better protect your personal data.

T-Mobile has upped its estimates of how many people were affected by its more recent data breach, adding another 6 million accounts for a new total of 54 million in an updated blog post today (Aug. 20).

If there's any silver lining, none of these new 6 million people had their Social Security numbers stolen, although most did have their names, dates of birth and phone numbers compromised. Those individuals are at slightly lower risk of identity theft than the 48 million whose SSNs and driver's licenses were pilfered.

• Identity theft victim? 6 things you need to do
• The best identity theft protection services
• Plus: AT&T denies 70 million user records were stolen from its servers

The less-good news is that about 13 million current T-Mobile customers did indeed have their phone numbers compromised, along with their International Mobile Equipment Identity (IMEI) numbers, which identify handsets, and their International Mobile Subscriber Identity (IMSI) numbers, which identify SIM cards.

Everyone affected by this breach is eligible for two free years of McAfee ID Theft Protection, paid for by T-Mobile. At the moment, pretty much anyone can sign up to try to get that deal, whether you've ever been associated with T-Mobile or not, though there's no guarantee you'll actually qualify.

Meanwhile, the lawsuits have begun. Vice Motherboard reports that a class-action complaint was filed yesterday (Aug. 19) in federal court in Washington state on behalf of four individuals said to be hurt by the T-Mobile data breach. The lawsuit does not specify an amount for an award but does demand a jury trial.

What you need to do

If you've ever had a T-Mobile account, or even just applied for one, you should take up the company on its offer of the free identity monitoring. That's true even if you already have identity theft protection coverage as the result of another data breach or that you pay for yourself.

You also need to change the password and PIN on your T-Mobile account. T-Mo says that only about 900,000 prepaid customers (including, as of today, 52,000 Metro by T-Mobile users) had their PINs and passwords compromised, and that it has already reset the PINs for those customers. 

Possibly as a result, it has also altered the official T-Mobile data breach response page to remove the links to reset your T-Mobile PIN and reset your T-Mobile password, although those pages are still up.

If you're among the 48 million people whose names, addresses, dates of birth and SSNs were stolen, or among the 6 million who had all that stolen except the addresses and SSN, contact one of the Big Three credit-reporting bureaus — Equifax, Experian and TransUnion — to have fraud alerts placed on your credit files. 

The bureau you contact will notify the other two. Here's how to get the fraud alert started.

You should also consider instituting a credit freeze with each of the Big Three. You'll have to contact each one individually, but here's how. Credit freezes can complicate efforts to get a loan or open a new payment account, but you can temporarily "unfreeze" your files for a day or two if necessary.

Who's affected by the T-Mobile data breach and how

Keeping track of all the different groups of people affected by this T-Mobile breach isn't easy, but here's our latest best effort.

• 7.8 million current T-Mobile customers who have postpaid accounts, the kind for which you get a bill in the mail. Many or most of these people have had their names, dates of birth, Social Security numbers, information from driver's licenses or other forms of ID, phone numbers, IMEIs and IMSIs compromised. Street addresses should also be considered compromised because those are on the driver's licenses. These individuals are at high risk of identity theft.
• 40 million former T-Mobile postpaid customers and persons who applied for T-Mobile postpaid accounts. Many or most of these people have had their names, dates of birth, Social Security numbers and driver's licenses or other forms of ID compromised. Street addresses should also be considered compromised. These people are also at high risk of identity theft.
• 5.3 million current T-Mobile customers with postpaid accounts. Many or most of these people have had their names, dates of birth, addresses, phone numbers, IMEIs and IMSIs compromised, but NOT their Social Security numbers or driver's licenses. (Some addresses don't seem to be tied to driver's licenses.) These people are at medium risk of identity theft — the absence of the Social Security numbers lowers the stakes a bit.
• 667,000 former T-Mobile postpaid customers. Many or most of these people have had their names, dates of birth, addresses and phone numbers compromised, but NOT their Social Security numbers or driver's licenses. These people are at medium risk of identity theft.
• 850,000 current T-Mobile customers with prepaid/pay-as-you-go customers. These people had their names, phone numbers and account PINs exposed. T-Mobile says it has reset the PINs for all those accounts. These people are at low risk of identity theft.
• 52,000 current Metro by T-Mobile prepaid customers. These may or may not be part of the 850,000 prepaid accounts already mentioned — T-Mobile is not clear about that. It's implied that these people's names, phone numbers and PINs were compromised.
• An undetermined number of names, phones numbers and PINs from inactive prepaid accounts.
• An undetermined number of phone numbers, IMEIs and IMSIs without any names attached.

T-Mobile maintains that no credit-card information or any other type of financial information was compromised in this breach.

Updated with comment from AT&T.

A well-known hacker (or hackers) says they've stolen the personal data of 70 million AT&T customers, including names, addresses, Social Security numbers, phone numbers and dates of birth.

In a statement to Bleeping Computer, however, AT&T said that it had looked into the claim and concluded that the data "does not appear to have come from our systems."

• What data breaches are and how they can hurt you
• The best identity theft protection services
• Plus: T-Mobile data-breach website lets anyone sign up for ID-theft protection

ShinyHunters, the hacker(s) auctioning the data online, insists that the data is the real thing.

"It doesn't surprise me," ShinyHunters told RestorePrivacy.com. "I think they will keep denying until I leak everything."

If the data is real — and it could still be real even if it didn't come from AT&T's servers — then those 70 million people are in dire danger of identity theft. 

The stolen personal information is all an identity thief would need to open accounts in other people's names, pose as them in job applications, or get identification documents such as driver's licenses.

RestorePrivacy said at least some of the data samples they had seen appeared to be real, and an unnamed security expert told Bleeping Computer the same.

This news comes just a few days after the revelation of a data breach at rival phone company T-Mobile, which compromised the names, addresses, dates of birth and Social Security numbers of at least 48 million people. T-Mobile has confirmed the incident.

Get ready to do these things

Regarding the supposed AT&T breach, we would normally advise anyone affected by such a serious incident to put fraud alerts on their files with the Big Three credit-reporting agencies Equifax, Experian and TransUnion. 

We'd also ask affected individuals to consider instituting credit freezes with the Big Three, although doing so can complicate getting a loan or opening new payment accounts. 

If AT&T confirms a breach of its systems, it will offer identity theft protection to affected users. If you're one of those users, take up the company on its offer.

But because we don't yet know whether this claim of an AT&T data breach is valid, it might be premature to act without further information.

Credible allegations

ShinyHunters' standard mode of operation is to steal data and offer to sell it in cybercriminal marketplaces. If there are no takers, then ShinyHunters posts the data online for free.

In the past couple of years, he, she or they have broken into databases belonging to at least 40 companies, although few are household names. 

ShinyHunters has implied that the breached companies can sometimes buy the data back, and indeed they told RestorePrivacy that they were willing to come to such an "arrangement" with AT&T.

More importantly, ShinyHunters' claims of data theft almost always turn out to be true. AT&T customers should hope this claim turns out not to be.

Tom's Guide has reached out to AT&T for comment and clarification, and we will update this story when we receive a reply.

Update: AT&T responds

AT&T responded to our query with the same statement that was given to Bleeping Computer:

"Based on our investigation, the information that appeared in an internet chat room does not appear to have come from our systems."

Our AT&T contact added that the company could not speculate on where the data had come from, or whether it was real.

Data scraped from about 700 million LinkedIn profiles — more than 90% of the entire declared LinkedIn member base — is being offered for sale in an online cybercrime marketplace.

The data includes full names, workplace email addresses, dates of birth, workplace addresses, mobile phone numbers, Facebook and Twitter IDs and links, job title, regional location and, in some cases, specific GPS coordinates — all of which appeared to be publicly accessible on LinkedIn profile pages.

• Data leaks aren't 'breaches' — but they're still screwing over users
• HP Pavilion Aero 13 is company’s lightest consumer laptop ever
• Plus: I used the OnePlus 9 Pro for three months — and I’ve changed my mind

Anyone who provided who provided all that information on their LinkedIn page is likely to get more spam, be the target of phishing attempts and perhaps even be at greater risk of identity theft. 

More significantly, many of the entries contain very specific GPS coordinates that may reveal where a LinkedIn user lives, which could be useful to stalkers and burglars.

The solution, as always, is to give LinkedIn as little information about yourself as possible, and to prevent the LinkedIn app — or any social-media app — from accessing your GPS data on your phone.

What you can do to protect yourself

You can avoid being swept up in the next data scrape by providing only the minimum amount of information required to maintain a LinkedIn account, or in fact any social-media account. 

Also be sure to go into your phone's settings and deny social-media apps access to your GPS coordinates. 

In Android, go to Settings > Apps & notifications > App permissions > Location and determine which apps should always, should only sometimes or should never have access to your location. In iOS, you can do the same by going to Settings > Privacy > Location Services.

GPS data exposed

However, quite a few entries contained specific geographic coordinates, certainly many more than had provided email addresses or phone numbers. 

It may be that those users used the LinkedIn mobile app and were not aware that the app could have grabbed their GPS data at the moment and uploaded it to LinkedIn servers.

The geographic coordinates were pretty easy to translate into map locations by copying and pasting the coordinates into Google. We found locations in New York City and Brazil, on the side of a road in rural France and in various cities in India. 

More alarmingly, we found coordinates that zeroed in on specific addresses in the Boston suburbs and in a small town in Wisconsin. Individual houses were singled out and visible in Google Street View and the houses' full addresses displayed. Names were attached to each of those listings.

That's pretty serious. It means you or I could drive to those houses, pound on the doors and ask for the residents by name — all because of data that was publicly accessible on LinkedIn. 

If anyone whose home address could be located with this data also happened to provide their date of birth along with the required full name, then an identity thief could try to use those three pieces of information to fraudulently open accounts in that person's name.

What we found in the scraped data

Tom's Guide had a look at the smallest sample of the scraped LinkedIn data, the only sample size that didn't require registration with a dodgy website. 

We found that while all 443 entries provided in the sample contained LinkedIn users' full names and LinkedIn IDs, URLs, usernames, most users voluntarily provided nothing else besides their general geographical location, i.e. a country, city or state. 

In appears most users knew well enough to give LinkedIn nothing but the bare minimum needed to maintain an account. Only about 7.5% of users in the data sample included a workplace email address. 

Personal email addresses were not asked for. Very few people provided mobile phone numbers, and we could find only one in the first 100 entries.

Second time this year

This incident comes just a few months after a separate incident that saw the posting of data collected from 500 million LinkedIn user profiles.

"We cannot be sure whether or not the records are a cumulation of data from previous breaches and public profiles, or whether the information is from private accounts," said Privacy Sharks, a website that analyzed a sample of the new data. 

"Considering that there are 200 million new records available, it is likely that new data has been scraped."

The person selling the data goes by the name TomLiner and posted a sale notice on the Raid Forums website, which is open to the public, on June 22. He or she is offering samples of various sizes, ranging from 1 million records to just a few hundred.

Another website that analyzed samples, Restore Privacy, said TomLiner told them the data had been scraped using LinkedIn's own API, or application program interface, a tool that lets your computer quickly interface with a website's server. 

LinkedIn's own website declares that it has 756 million users. If this stolen data really amounts to 700 million users, that's about 92.5% of LinkedIn's entire user set. If you have a LinkedIn account, then your data is probably part of this.

Data breach or not, your information is still exposed

In other words, this isn't technically a data breach, and no hacking was involved, just as happened with the 500 million LinkedIn profiles scraped a few months ago. 

Then as now, LinkedIn absolved itself of responsibility in a statement to Privacy Sharks: "This was not a LinkedIn data breach and our investigation has determined that no private LinkedIn member data was exposed."

It also isn't as bad as the 2012 LinkedIn data breach that revealed the private information of about 117 million LinkedIn users, including their personal email addresses and their poorly encrypted passwords. Even Facebook founder Mark Zuckerberg had his email address and password exposed in that one.

Still, that's going to be small comfort to the people who trusted LinkedIn to guard their data. As privacy expert Melanie Ensign said in a recent opinion piece for Tom's Guide, "plenty of harm can be done with information that companies force users to share in public profiles."

"Whether the data was stolen, leaked, or scraped, the result for consumers is the same," Ensign added. "Their privacy was violated by a company they thought they could trust."