ace of Merlin's customers had their login info compromised. Merlin detected inappropriate search activity on march 22, 2011. Someone without authorization was able to access Merlin's databases for 21 hours. Names, addresses, phone numbers and social security numbers were exposed. Merlin began sending notification letters on April 11, 2011.