Description

I got a postal letter from NYU that offered a free one year membership in Identity Defense to cover the recent data breach on March 22, 2025. The letter provided a link "app.identitydefense.com/enrollment/activate/nyu". When I visited the link, a human verification checkbox appeared. After checking the box, I was suddenly spammed with a bunch of what seems to be McAfee ads that appear to "read" my system and claimed that I have 5 undetected viruses. Aside from being littered with malware protection ads, there wasn't any indication that I was on the Identity Defense website. Also, I checked the mailer's address "P.O. Box 3826 Suwanee, GA 30024" and it appears to be unaffiliated with NYU's own addresses, all of which are based in NY. While searching, I noticed an article ("https://komonews.com/news/consumer/data-breach-letters-offer-free-credit-monitoring") that was also related to data breach letters offering free credit monitoring that mentioned a similar address "Secure Processing Center in Suwanee, GA" that the scammers were using. I also looked up the Identity Defense service and it was very shady. Many people gave it poor ratings and claimed that their main business was to collect user information to sell to third parties. Also, the Identity Defense wanted several very important personally identifiable information that I didn't feel confident giving out, such as legal name, home address, phone number, date of birth, and social security number. I don't think an actually reputable service would directly ask you for those kinds of sensitive information. The letter mentioned a deadline to enroll which for me was September 2, 2025. Lastly, I found a similar letter template hosted in the file system of the State of California Department of Justice Office of the Attorney General website ("https://oag.ca.gov/system/files/NYU%20-%20California%20Notification.pdf"). The letter template almost matched the letter I received word for word, all of which furthered my suspicions.