Don't forget the federal government itself. I've still got 1 year remaining from the 10 years of monitoring I got from the OPM breach wayyy back when.
Related, any company offering monitoring should be required to pay for a serialized version. The 10-20 or so settlements that require monitoring in my lifetime have been useless because I already have it for a longer period.