In Announcement 2015-22, the IRS announced that the value of identity protection services, such as credit monitoring, identity theft insurance policies, and identity restoration services, provided to an employee whose personal information may have been compromised in a data breach is not taxable as gross income. The Announcement does not apply to cash received in lieu of identity protection services; identity protection services received for reasons other than as a result of a data breach, such as services received in connection with an employee’s compensation or benefits package; or proceeds actually received under an identity theft insurance policy.

Announcement 2015-22 is available here.