The Breach Letter Named 2.3 Million of Us — My Son's Social Security Number Was Already in Use
Meridian Diagnostics lost 2.3 million patient records in February. My son's Social Security number was in the batch. Someone opened a collections account in his name for $1,100. I froze his credit at all three bureaus by March 6. The dispute cleared March 20. I paid nothing for monitoring.
Two million three hundred thousand. That is the headcount on the breach letter from Meridian Diagnostics, postmarked February 27, and I read it at 6:05 on a Monday mornin' while standing in the hallway in socks with my phone buzzing against my palm, because Credit Karma had flagged a brand-new Experian file for Leo, who is nine years old. Nine. He owns a bicycle, three LEGO sets, and, as of February 19, a collections account.
The file was not empty. Riverbend Recovery, a collections outfit in Ohio, had opened it with a $1,100 debt tied to a gas station chain in Akron, a city my son has never visited, and the file already carried a computed score of 512. His credit score existed four years before he is legally allowed to hold a job. A delinquent tradeline like that rides a kid's report for seven years, which lands him at 16 trying to open his first checking account with a history he didn't create.
The letter offered 24 months of free credit monitoring, and I declined it, cuz monitoring would have notified me of a problem I had already found, and the actual repair work is done by a freeze, which costs nothing and blocks new accounts outright. The freeze takes three phone calls, two stamps, and one envelope to Arkansas. All three went out that week.
the letter, postmarked February 27
Meridian Diagnostics is a lab billing vendor, the middleman between pediatricians and insurance companies, and Leo's strep test in 2024 passed through their system with his name, date of birth, and Social Security number attached. The letter said attackers had access from October 3 to January 8. Names, birth dates, SSNs, insurance IDs. Enrollment in their free monitoring closes May 31. The tone of the letter apologized to 2.3 million people at once and then handed me a website.
a Credit Karma alert at 6:05 am
I opened Leo's Credit Karma profile in 2023, after a different vendor letter from a hospital system prompted me to check whether my kids had files. Nothin' existed then, which is the correct state for a second grader. This time the app showed a new Experian file opened February 19 with an open collection on it. I screenshotted it at 6:06 and woke my wife up. She asked who Akron was. Nobody, I told her. Akron is nobody we know.
the three freeze calls
A security freeze is free at all three bureaus under federal law, and for a minor the parent does it with documents. Equifax took 20 minutes online. Experian wanted paper: a copy of my license, Leo's birth certificate, a utility bill, all mailed to a processing address in Arkansas. TransUnion got the same packet February 20 and turned it around in nine business days. Every bureau sent back a confirmation with a PIN, and I jotted each PIN on two separate pieces of paper cuz losing one felt expensive. Total cost: two stamps. Total time: about three hours spread across a week.
the $1,100 account in Akron
The disputed account was opened February 19, a fuel card at a chain called Buckeye Fuel, defaulted immediately, and landed with Riverbend Recovery within what looked like days. I filed an FTC identity theft report at identitytheft.gov that evenin', which builds you a recovery plan and a printable affidavit, and an Akron police report online, report number 26-04417. Leo was at school the whole time, learning fractions. Somebody in Ohio was being industrious with his number while he stacked fraction bars.
the dispute packet, 31 pages
I mailed Riverbend and Experian the same packet, certified, on March 3: cover letter, FTC affidavit, the Akron report, Leo's birth certificate, a copy of the breach letter, and the Credit Karma screenshot, 31 pages total in the order I wanted 'em read. I photocopied every page first. My wife suggested a folder. The folder now says MERIDIAN on the spine and lives in the fire box with the passports.
the freeze blocks, the monitor watches
Freezes stop new credit accounts, full stop, and that was the entire attack surface that mattered here. They do not watch anything, alert me to anything, or sell me upgrades. They do not expire. When Leo turns 18 and wants his first card, we thaw the file with the PIN, it takes about an hour online, and we refreeze it the same day. A nine-year-old with no credit score is not a vulnerability. It is the target state, and the freeze is how you keep it.
the monitoring plan I didn't buy
The letter's vendor would have monitored all three bureaus for 24 months at no cost, and family plans at LifeLock run $19.99 a month if you want dark web scans and bank account alerts stacked on top. I weighed it for about a day. Then I listed what monitoring does after a freeze: nothing that can be acted on, because nothin' can be opened. We will revisit at 18. The $240 a year stays in the college fund instead.
March 20, the letter back
Riverbend's response arrived March 20: account closed as fraudulent, tradeline deleted, no further action. Experian confirmed the same week that Leo's file was not corrected. It was deleted. His credit profile went back to not existing, which took the fake 512 score with it. The freeze confirmations are pinned in my email under a label called KIDS-LOCKED. The breach letter went into the folder. The screenshot from 6:05 is still on my phone. Freeze first. Monitoring later, maybe never. That is the whole system now.