“On or around January 17, 2025, we discovered suspicious activity within our network and immediately initiated an investigation of the matter. We engaged independent cybersecurity experts to assist with the process. As a result of the investigation, on or about February 10, we determined that certain files that contained personal information may have been acquired from our network without authorization.”

💡 Best Collateral took nearly a month to confirm data theft, leaving victims unaware and vulnerable during the critical early period.

“Please note that we have no evidence of the misuse, or attempted misuse, of any potentially impacted information.”

💡 This statement provides false reassurance since identity thieves often sit on stolen data for months before using it.

“It may have included your name, health insurance policy information, and/or Social Security numbers. If you have been a customer, the information may have included your name, driver’s license number, biometric information, and/or military identification number.”

💡 The breach exposed irreversible biometric data and military IDs, creating permanent identity theft risks.

“Best Collateral is also offering you complimentary identity protection services through TransUnion, a leader in consumer identity protection. These services include 12 months of credit monitoring, dark web monitoring, a $1 million identity fraud loss reimbursement policy, and fully managed identity theft recovery services.”

💡 Twelve months of monitoring is inadequate for biometric data that cannot be changed and creates lifetime risk.

“The deadline to enroll in these services is 90 days from the date on this letter.”

💡 The 90-day window may cause victims who delay to lose access to even the limited protections offered.

“The enrollment requires an internet connection and e-mail account and may not be available to minors under the age of 18 years of age.”

💡 These requirements exclude victims without reliable internet access or email, disproportionately harming vulnerable populations.

“We take your trust in us and this matter very seriously. Please accept our sincere apologies for any worry or inconvenience this may cause. Sincerely, Robert E. Verhoeff, President, Best Collateral, Inc.”

💡 The president offers apologies but no acknowledgment of responsibility, consequences, or specific corrective actions.

“We also notified the Federal Bureau of Investigation and will cooperate with any resulting investigation and will provide whatever cooperation may be necessary to hold the perpetrators accountable.”

💡 Best Collateral shifts focus to external criminals rather than explaining what internal security measures failed.

“Best Collateral takes the privacy and security of all information within its possession very seriously.”

💡 This boilerplate claim rings hollow when the company failed to prevent unauthorized access to highly sensitive data.

“Please note that when signing up for monitoring services, you may be asked to verify personal information for your own protection to confirm your identity.”

💡 Victims must provide additional personal information to access monitoring, creating further privacy risks and administrative burden.

“As soon as we discovered this incident, we took the steps described above and implemented measures to enhance security and minimize the risk of a similar incident occurring in the future.”

💡 Best Collateral provides no specifics about what security measures failed or what concrete improvements have been made.

“12478885v2”

💡 The version number at the top of each page indicates this is a templated legal document, not a personalized accountability communication.