Breach Letter in Hand? Why the Clock That Matters Is Your State's, Not Yours
Breach notification began as a single California statute in 2003 and spread state by state, which is why two households can get very different letters about the same incident.
The envelope is thin, the letterhead belongs to a company you barely think about, and the first paragraph apologizes before it explains. Most people read it twice, feel a jolt, and then do something within the hour: freeze a card, change a password, click the enrollment link at the bottom of page two. The instinct is understandable and mostly harmless, but it is aimed at the wrong target. The letter is not an alarm. It is a compliance document, written by lawyers, whose contents were dictated by the law of the state where you happen to live.
The letter exists because California decided it should, in 2003
There was no such thing as a data breach notice for most of the history of computerized records. Companies that lost customer files handled it internally, told regulators nothing, and told customers less. That changed with California's SB 1386, signed in 2002 and effective in July 2003, which required businesses holding unencrypted personal information about California residents to tell those residents when it was acquired by someone unauthorized. The statute was short and its logic was simple: people cannot protect themselves against a risk they do not know exists. Everything you now recognize as a breach letter descends from that one paragraph.
What followed was not a federal statute but a slow, uneven copying exercise. State legislatures adopted their own versions through the 2000s and 2010s, each borrowing California's structure and then adjusting it, until Alabama and South Dakota closed the map in 2018 and all fifty states had something. Because the copying happened one capitol at a time, the differences are not cosmetic. States disagree about what counts as personal information, what counts as a breach, how fast the notice must go out, whether the state attorney general gets a copy, and whether the company has to pay for anything on your behalf.
Your address, not the company's, picks the rulebook
This is the part people get backwards. A breach at a company headquartered in Texas that spills records on a household in Vermont is governed, for that household, by Vermont's statute. Notification law follows the resident, which is why a single incident produces several versions of the same letter and why comparing notes with a relative two states away can be confusing rather than reassuring. Your cousin's letter may name a specific number of days, promise two years of credit monitoring, and describe a state agency you can complain to. Yours may do none of those things and still be fully lawful.
The variation shows up in a few predictable places. Some states require notice without unreasonable delay and leave it there; others attach an outside limit measured in weeks, commonly thirty, forty-five, or sixty days from discovery. Some define personal information narrowly, essentially name plus Social Security number, driver's license number, or financial account credentials; others have added health information, biometric data, passport numbers, taxpayer identification numbers, and username-and-password pairs. A minority require the company to offer credit monitoring at its own expense for a fixed term, usually a year or two, and that obligation is the reason the offer appears in some letters and not others.
Layered on top of the state map are sector rules that override or supplement it. Medical providers and their business associates report under the federal HIPAA breach notification rule, built out by the HITECH Act in 2009, which sets a sixty-day outer limit and sends large incidents to the Department of Health and Human Services. Banks and other financial institutions operate under the Gramm-Leach-Bliley framework and their regulators' guidance. Publicly traded companies have had to disclose material cybersecurity incidents to the Securities and Exchange Commission since rules took effect in late 2023. The Federal Trade Commission oversees the general consumer side, including how companies describe their own data practices.
The questions worth asking, and what a weak answer sounds like
Every letter includes a phone number, and almost nobody uses it. That is a mistake, because the letter is written to satisfy a statute in the smallest number of words, while the person on the phone is reading from a script with more detail than the mailing. Start with the flat question: which specific data elements about me were involved. Not which categories the company holds. A good answer names fields, so you learn that your name, address, and account number were in the file but your Social Security number was not. A weak answer restates the letter, says it is still under investigation, or offers the phrase may have included and stops there.
Ask next when the intrusion began and when it ended, then ask when the company discovered it. The gap between those two dates tells you how long the data was exposed and how stale it may already be, and a company that will not give you a discovery date is usually managing a legal position rather than protecting an investigation. Ask whether the file was encrypted, because encryption is the trigger that many state statutes turn on, and a specific answer means someone has actually looked. Ask whether the incident was reported to your state attorney general, which tells you whether an outside party has a copy.
The last question is the one that separates a serious response from a public relations gesture. Ask what the company is doing to keep the same file from leaving again, and listen for whether the answer describes a change or a feeling. Enhanced monitoring and taking security very seriously are feelings. Rotating credentials, retiring the affected system, ending a vendor relationship, and shortening how long records are retained are changes. You will not get a technical audit over the phone, and you should not expect one, but you can tell within a minute whether the person has been given something concrete to say.
Why the first day is the wrong day to act
Speed has a real cost here, and it is not the cost people assume. The first cost is that breach letters are the single most reliably imitated piece of mail and email in circulation, because the format is public, the tone is apologetic, and the recipient is primed to click. A person who acts within minutes of reading a notice is exactly the person who will act on the follow-up that looks almost identical and arrives a week later. Waiting a day, then reaching the company through a number you look up independently rather than the one printed for you, removes that whole category of loss.
The second cost is that the remedies have an order, and doing them out of order wastes the good ones. A security freeze at each of the three nationwide credit bureaus has been free by federal law since September 2018, applies whether or not any company offers you anything, and blocks new-account fraud in a way that credit monitoring, which only tells you after the fact, does not. Enrollment in the company's monitoring product is worth taking, but it is a notification service, not a lock, and it sometimes arrives bundled with terms about how disputes get resolved. Read those terms once, deliberately, rather than accepting them in a hurry.
The third cost is misdirected effort. Closing a long-held credit card because its number appeared in a file shortens your credit history and does nothing that a replacement number would not do. Changing one password matters less than changing the reused version of that password everywhere else it lives, which takes an evening and a list. Tax-related identity theft, which follows Social Security number exposure, is addressed through the IRS rather than the breached company, and that is a separate errand with its own paperwork.
A breach notice is the end of somebody else's bad month and the beginning of a short, unglamorous project of yours. Give it an hour on a weekday evening: read the letter for what it names and what it carefully avoids naming, call and ask the five questions, freeze first, enroll second, and write the date on the letter before filing it where you can find it in a year. The arrangement that produced that envelope took two decades and fifty legislatures to build, and it works best for the reader who treats it as information rather than as an emergency.