500,000 victims receive data breach letter, not a scam