Caltrol Inc. discovered technical issues with its server on February 1, 2025. After bringing in outside cyber counsel and independent IT specialists to investigate, the company determined that an unauthorized actor had gained access to its systems between January 27 and February 1, 2025, and had exfiltrated data during that window. This was a case of hacking or system intrusion, not a lost device or an employee mistake — someone outside the company broke in and took information before Caltrol could shut off access.
This particular letter was sent to a family member — a child or spouse — of a Caltrol employee, because the company had collected that person’s information as part of its employee records. Caltrol has not stated in this letter how many people in total were affected, so if you’re reading this because you received a notice, it means your name and Social Security number specifically were confirmed to be part of the data the attacker took.
What information was exposed?
- First and last name
- Social Security number
Caltrol is offering affected individuals free Single Bureau Credit Monitoring, Single Bureau Credit Report, and Single Bureau Credit Score services through Cyberscout, a TransUnion company. To enroll, go to https://bfs.cyberscout.com/activate and enter the unique enrollment code included in your letter. You must sign up within 90 days from the date of the letter, and the service requires internet access and an email account.
What should you do now?
- Enroll in the free credit monitoring Caltrol is offering through Cyberscout before the 90-day deadline, using the code printed in your letter.
- Because your Social Security number was exposed, consider placing a fraud alert or a full credit freeze with Equifax, Experian, and TransUnion — freezes are free and stop most new accounts from being opened in your name.
- Pull your free credit reports at annualcreditreport.com and look closely for accounts or inquiries you don’t recognize.
- Watch for unexpected mail, tax filing rejections, or notices about accounts you never opened, since a stolen SSN can be used long after the breach itself.
- For ongoing peace of mind, consider signing up for a service like Aura or LifeLock, which can alert you if your information appears elsewhere, such as on the dark web or in a new credit application.
- If you notice suspicious activity, report it promptly to the relevant financial institution and consider filing a report with the FTC at identitytheft.gov or with local law enforcement.
If you have questions, Caltrol can be reached through Cyberscout’s dedicated assistance line at 1-800-405-6108, Monday through Friday 8:00am – 8:00pm EST, excluding major U.S. holidays.