Companies are not required to offer services to consumers whose information was involved in a breach. Nonetheless, many organizations choose to offer credit reports, credit monitoring, identity restoration services, and/or identity theft insurance. If you do offer one of these services a 2014 California statute prohibits you from charging the consumer for them. . .