Kroll monitoring is legit. Kroll is a large New York risk-advisory firm, and organizations that lose people's data hire it to mail the breach letters and run free identity monitoring for the people affected. So if you're asking "is Kroll monitoring legit" with a letter in your hand, from a company you may barely remember dealing with, the offer itself is real and costs you nothing. What deserves a closer look is the address you type in, because scammers copy these letters too. Enrolling is usually worth the ten minutes, though it won't do much on its own.
We checked the details below on November 2, 2026, against Kroll's live pages and against real 2026 breach letters filed with state attorneys general.
Is Kroll monitoring legit? Start with who Kroll is
Kroll's about page puts its staff at 6,500 in more than 30 countries and territories, with headquarters at One World Trade Center in New York. The investigations firm dates to 1972. Duff & Phelps agreed to buy it from Corporate Risk Holdings in March 2018. In April 2020 Duff & Phelps was itself acquired in a deal valued at $4.2 billion by an investor group led by Stone Point Capital and Further Global, with Permira's funds keeping a significant stake. In February 2021 the combined company took the Kroll name. So is Kroll legit as a company? It's a private firm that has been in the investigations business for over 50 years, not a startup that appeared with your letter.
Breach response is one department of that firm. Its breach-notification group sells the whole package to the organization that was hacked: the letters, the call center, then the monitoring. You never chose Kroll. The company that lost your data did, and it's paying. DentaQuest's 2026 letter template even has a "Return to Kroll" line at the top, though the company signs it. On the sign-up portal you deal with a separate Kroll entity, Kroll Information Assurance, LLC, which is the name you'll see in the portal agreement.
What Kroll identity monitoring includes
There's no single Kroll product. The breached organization picks a package and a term, and your letter lists exactly what it bought. Four real letters show how much that varies.
| Letter | Free term | Credit monitoring | Anything extra |
|---|---|---|---|
| Small employer, payroll breach (Nebraska AG, June 2026) | 12 months | One bureau | None |
| Moody Bible Institute (California AG, July 2026) | One year | All three bureaus | None |
| DentaQuest, letter to parents (California AG, 2026) | 24 months | None (child's SSN watched instead) | Minor Identity Monitoring |
| Pinnacle Claims Management (California AG, 2022 incident) | 12 months | Yes | Web Watcher, Public Persona, Quick Cash Scan, $1 million fraud loss reimbursement |
Every one of them also includes the two services that matter most. Fraud Consultation means "unlimited access to consultation with a Kroll fraud specialist," who can explain an alert and help with fraud alerts. Identity Theft Restoration means that if someone does use your identity, "an experienced Kroll licensed investigator will work on your behalf." Kroll's restoration page says those investigators will place fraud alerts and prepare dispute letters for you. Then they keep working each problem "until they have been verifiably resolved" with the banks and collectors involved.
The credit piece reads your file at one or more of the three bureaus and alerts you to changes such as a new account or a change of address. Kroll's credit monitoring page says it can run on one bureau or all three, which is why the letters differ. To get it, the 2026 letters say you "must be over the age of 18 and have established credit in the U.S.," with a Social Security number and a U.S. address tied to that credit file.
Note what the 2026 letters leave out. None of the three we read lists insurance or a reimbursement amount. The $1 million reimbursement in the Pinnacle letter was part of that client's package, so don't assume yours has it unless your letter says so. Kroll's identity monitoring page describes a wider menu it can sell, including web monitoring of identifiers like your SSN and medical ID numbers. A given letter may include only part of it.
Kroll monitoring for children
If a child's data was in the breach, the parent gets a separate letter. DentaQuest's 2026 version offers Minor Identity Monitoring for 24 months, which alerts you when a name or address becomes "associated with your child's Social Security number." The letter points out that a child shouldn't have a credit file at all, so one turning up can itself be a warning sign. It carries its own activation code for the child.
Is the Kroll breach letter real? How to check before you enroll
Scammers know a Kroll letter gets opened, so check the address and what the page asks for before typing anything in.
Real letters send you to a small set of Kroll addresses. The 2026 letters we read all say to visit enroll.krollmonitoring.com/redeem, and all point to info.krollmonitoring.com for background. Once you have an account, you sign in at login.krollmonitoring.com. Kroll's own help page confirms that enrollment happens at enroll.krollmonitoring.com. If the address you've been given ends in anything else, stop. Call the company that sent it. Type the address from the paper letter yourself instead of clicking a link in an email.
One older pattern still floats around. Kroll ran at least one incident site as a kroll.com subdomain, 2023monitoring.kroll.com, and it still loads. When we checked on November 2, 2026, the matching addresses for 2020 through 2022 and 2024 through 2026 didn't exist at all. A letter that sends you to "2026monitoring.kroll.com" is pointing at a site Kroll doesn't run.
The real first screen asks very little. The /redeem page wants the Activation Code and Verification ID from your letter, the second in the format "SF-123456". Kroll monitoring enrollment has one other door. The page at enroll.krollmonitoring.com/create-account asks for a Member Number plus your last name and ZIP code. It notes that "You can find your membership number in the communication you received." Neither one asks for money. After that comes identity verification, where Kroll asks for your SSN and quizzes you on your background.
There's one thing that can look suspicious but isn't. Kroll's web monitoring can watch for your card and bank account numbers, and its agreement lists them among the data it may collect for that. Adding a number to a watch list is different from paying with it. A page that wants a card to charge or a bank login is not Kroll's.
Finally, check that the incident makes sense. If you've never heard of the company, that alone doesn't make it fake. Pinnacle's letter went to people whose employer's health plan used Pinnacle, and DentaQuest's went to families whose health plan used DentaQuest for dental or vision benefits. If you want to be sure, look up the company's number yourself and ask.
Does Kroll call or email you first?
A breach notice can come by post or by email, and Kroll's help page refers to both. After you enroll, alerts arrive by email, according to Kroll's monitoring page.
Kroll's consumer services team won't discuss your breach at all. The help page says to "contact the phone number in the letter, email or post card you received if you have questions about a data breach," because that team can't help with them. It handles sign-up trouble only, at websupport@kroll.com, 7:00 am to 7:00 pm Central on weekdays. Enrollment, in every letter we read, is something you start yourself on the website or at the letter's phone number. If someone rings you claiming to be Kroll and asks for your SSN to "activate your protection," hang up and call the number printed on the letter.
Phishing that uses Kroll's name, and Kroll's own 2023 incident
In August 2023, Kroll's bankruptcy-claims business disclosed that an attacker had taken over a Kroll employee's phone number in a SIM swap on August 19, 2023. Kroll told KrebsOnSecurity that T-Mobile moved the number to the attacker's phone without authorization. With it the attacker reached files holding personal information of claimants in the FTX, BlockFi and Genesis crypto bankruptcies.
Kroll's incident page for FTX claimants says the files held claimants' contact details and FTX account balances. For a small number of people they also held dates of birth. Kroll emailed affected claimants on August 25 and November 2, 2023. Its notice said there was "no evidence that the attacker accessed any other Kroll accounts or systems." Phishing aimed at those claimants followed, and the page names one scam sender, info@omnichannel.blaster.biz, and tells people not to click its links.
That incident was in a different part of Kroll from the one running your monitoring, but the warning page is still useful. It lists what Kroll and the court "will never ask or require you to do," including giving your password over the phone or by email. Sending your SSN "over email, social media" outside the court process is on the list too. That list is a good test for any message with Kroll's name on it.
Does enrolling give Kroll or the breached company more of your data?
It gives Kroll more, yes. To set up credit monitoring, Kroll's informational page says it uses your SSN "for the Identity Verification process" and shows you questions whose answers are "unique to your background information." Accepting the agreement gives "written instructions" to the credit bureaus and to Kroll's service provider CSIdentity Corporation to pull your credit files and exchange information about you. If you add bank or card numbers to watch, Kroll holds those too.
The agreement says Kroll shares your information with its affiliates and with service providers it hires, such as call centers and data hosts. Nothing in that sharing clause says your enrollment details go back to the company that was breached. The company already gave Kroll your name and address so the letter could be sent. Enrolling doesn't hand it anything new.
We think the trade is usually worth it. Kroll handles this for millions of people, and the information it asks for is what any credit monitoring needs. The Moody Bible letter also states that "enrolling in this program will not hurt your credit score."
Kroll monitoring is legit, but should you enroll?
Usually, yes. It's free for the term in your letter, and the restoration service is the most valuable part. If fraud does start, you get a licensed investigator who does most of the cleanup for you instead of you spending weekends on the phone with banks. That help is only there if you enroll before the deadline.
Watch the deadline. Each letter has its own. The Nebraska letter gave until September 30, 2026. The Moody Bible letter gave until October 26, and both dates have now passed. And remember that monitoring tells you about fraud after it starts. A credit freeze, covered below, stops new accounts being opened in your name in the first place.
What happens when the free monitoring ends
Nothing gets billed. The sign-up never asks for a payment card, and we found no prices or renewal terms anywhere in Kroll's portal agreement or terms of use. When the term in your letter runs out, the service stops. The agreement also lets you close your account at any time. Kroll can end it early for cause. It can also end it for any reason with 90 days' written notice where practicable.
If you want monitoring to continue after that, you'd have to buy it from someone else.
Kroll vs. LifeLock or Aura: is paying worth it?
The paid products add insurance, and they're subscriptions. LifeLock's cheapest plan, Core, costs $124.99 a year or $12.49 a month on its plans page, which notes an "automatically renewing subscription required." It bundles identity theft reimbursement of up to $1.05 million. Aura's Individual plan costs $12 a month billed annually or $15 billed monthly. It includes three-bureau credit monitoring and $1 million of identity theft insurance. Both prices were current on November 2, 2026. Our LifeLock cost guide goes through every plan and renewal price.
Kroll's free package often matches the core of those products. Credit monitoring and a restoration specialist come with every letter we read. LifeLock's plans list the same pair, with "Identity Restoration Specialists" on every tier. The real difference is insurance, which most 2026 Kroll letters don't include. Our advice is to take the free Kroll term first and freeze your credit. Pay for a subscription only if you want something specific that Kroll's package lacks, and put a reminder in your calendar for the renewal date. Neither the free product nor the paid ones remove you from people-search sites.
Credit freeze vs. monitoring: do you need both?
They do different jobs. A credit freeze blocks new credit in your name. The FTC says that while one is in place "nobody can open a new credit account in your name, including you," that placing or lifting it is free, and that it "doesn't affect your credit score." You contact all three bureaus to place one, and lift it at the one bureau a lender will check when you need credit.
Monitoring watches for things a freeze can't stop. Your SSN might turn up for sale online. A new address might appear on your credit file. A freeze is the stronger protection against new accounts. If you only do one thing after a breach letter, make it the freeze. If you can do two, do both.
What to do if your Kroll activation code expired or you lost the letter
Start with the phone number printed in the letter, or the company's own breach notice if you no longer have the letter. Kroll's support team can't look up your code or reopen a deadline. Its help page sends breach questions back to the number in your notice.
If the letter is gone, you can often find the company's sample letter, with the call-center number, on a state attorney general's breach site. California's and Nebraska's are where we read the letters in the table above. Some companies keep enrollment open by phone. DentaQuest's web notice, for example, set no enrollment deadline and gave a number that both confirms whether you were affected and enrolls you. Our DentaQuest breach guide has the details.
If the deadline has passed and the company won't extend it, you haven't lost much. You can still place a credit freeze for free. You can also pull your free credit reports.
The breached company's other remedies: class-action settlements
Big breaches often end in a class action. AARP's guide mentions AT&T agreeing to pay $177 million over two 2024 breaches. If a case covering you settles, you'll get a separate notice explaining how to file a claim. Those come from a settlement administrator, and Kroll is one of the large ones. Its settlement administration business says it has managed more than 4,000 settlements. So a second envelope from Kroll about a "settlement" may be just as real as the first one about monitoring.
Settlement notices get faked as well. The same AARP guide says filing a claim should never cost anything. It also suggests finding the settlement website yourself by searching the case name, and checking that the case number matches your notice. Kroll's monitoring help team can't answer settlement questions either, so use the contact details on the settlement's own site.
What Kroll monitoring doesn't do
Monitoring is built to tell you after the fact. Kroll's own page says organizations offer it "to reveal known triggers of identity theft that credit monitoring alone would not expose." An alert tells you your data turned up somewhere or was used. It doesn't stop the use, and it can't pull the data back.
It also doesn't touch people-search sites. Breach data and the public-record data on those sites travel different routes, but both end up describing you. Nothing in a Kroll package claims to remove a listing. You can see what those sites hold without paying. Many people-search sites run an opt-out search that shows what they hold without a subscription. Filing removals takes longer than people expect. From our own work, BeenVerified's online opt-out removes only one record per request and asks you to email for the rest. The PeopleConnect sites (TruthFinder and Intelius among them) send a verification code to a phone or email that's already on your record, which is a problem if that number isn't yours anymore. Our guide to removing personal information from the internet goes through the sites one by one.
What to do after a Kroll breach letter
Enroll first, typing the address from the letter yourself. Then freeze your credit at all three bureaus. The freeze does more than any monitoring product to stop new accounts in your name.
After that, change the password on the breached account and anywhere you reused it. Expect phishing that mentions the breach for the next year or so, since anyone holding the stolen list has a believable excuse to email you. Our guide on what to do if you've been hacked covers what to do if one gets through. In a few months, search your own name on a couple of people-search sites and file removals for what you find.
If you're curious how these incidents happen, our explainer on how data breaches happen covers the usual routes in. The Conduent breach timeline is a worked example of one that came with Kroll letters.
Common questions
Is Kroll monitoring a scam?
No. It's a real service from a real firm, paid for by the organization that was breached. The scams are lookalike pages and emails that borrow Kroll's name. That's why you type enroll.krollmonitoring.com from the letter yourself instead of clicking a link.
Is Kroll identity monitoring really free?
Yes, for the term in your letter. The sign-up asks for no payment card, and Kroll's portal agreement contains no prices or renewal terms. When the term ends, the service stops without charging you.
Why does Kroll want my Social Security number?
Credit monitoring reads your credit file, and Kroll verifies it's really you with your SSN and questions drawn from your credit history. Kroll's FAQ says the number is used "for the Identity Verification process required to create your account."
How long does the free monitoring last?
It depends on what the breached organization bought. The 2026 letters we read ran from one year to 24 months. Your letter states your term and your enrollment deadline.
Does enrolling in Kroll monitoring hurt my credit score?
No. The 2026 Moody Bible letter says enrolling "will not hurt your credit score."
Does Kroll identity monitoring remove my information from the internet?
No. It watches for your identifiers and alerts you. Getting your data off people-search and data broker sites is a separate job, with one opt-out per site.
Can I enroll my child?
Only if the breach included your child's data, in which case you'll get a separate letter with the child's own activation code. DentaQuest's 2026 parent letter offered 24 months of Minor Identity Monitoring, which needs the child's SSN and a U.S. address.
Is this the same Kroll that sends bankruptcy and settlement notices?
Same company, different departments. Kroll Restructuring Administration handles bankruptcy claims, and its settlement business handles class actions. That's why letters from Kroll can look so different from each other.
Getting off people-search sites after a breach is the part we work on. Delist My Data files the removals and keeps checking the sites, so a listing that comes back gets filed again. We're in pre-launch, and the waitlist is open.