Got a Breach Letter? What the Law Made Them Tell You, and What They Chose To

Every state has a data breach notification statute, and by the time a letter reaches your mailbox it has been drafted to satisfy the strictest of the ones that apply to anybody on the mailing list. That is why the language reads the way it does: careful, passive, precise in a few places and deliberately unhelpful in others. I spent an afternoon with a practitioner who has run notification programs from the company side for more than a decade, on the condition that I not name the employers involved. What follows is her account of what the rules actually compel, what they leave to a lawyer's judgment, and which questions get a real answer out of the call center.

The letter is a compliance document before it is a courtesy

Why do two letters about similar incidents read so differently?

Because they were written against different rulebooks. State statutes vary in what they require the notice to contain, and a company mailing to residents of thirty states either writes thirty versions or writes one version that clears the highest bar in the set. Most firms write one. So a Massachusetts requirement or a California content rule ends up shaping the paragraph a reader in Ohio receives. The differences you notice between two letters are usually differences in where the recipients live and in how conservative outside counsel was, not differences in how bad the incident was.

What is genuinely mandatory in the body of the notice?

Broadly, the fact that an incident happened, the categories of personal information involved, the approximate date or date range if it is known, and contact information for follow-up. Many states also require language about the credit bureaus and about security freezes. What is almost never mandatory is a narrative of how the intrusion occurred, the name of the vendor if a vendor was the point of failure, or a per-person inventory of what was taken. Those omissions are choices. The categories line is the one worth reading twice, because it is the sentence the statute forces them to get right.

What counts as a breach, and what quietly does not

Does every exposure produce a letter?

No, and understanding why keeps people from assuming silence means safety. Most state statutes define personal information narrowly: a name combined with a Social Security number, a driver's license or state identification number, or a financial account number together with the code that would let someone use it. Some states have added medical information, health insurance identifiers, biometric data, and online account credentials. An exposure of email addresses and order histories often falls outside the definition entirely. It may still matter to you. It simply does not trigger the statute, which is a distinction worth holding onto when a company says no notification was required.

And the phrase about no evidence of misuse?

That sentence is doing real legal work. A large number of states allow the company to skip notice if, after a documented analysis, it concludes the incident is not reasonably likely to result in harm. When that analysis goes the other way and the letters go out anyway, counsel usually wants the file to show the conclusion was close. So you get a letter that notifies you and simultaneously records that no misuse has been observed. Read it as a statement about what the investigation found by a certain date, not as a prediction, and certainly not as reassurance about the next two years.

The clock, and what the timing tells you

People are angry about receiving a letter months after the incident. Is that lawful?

Often, yes. Most state statutes say notice must go out without unreasonable delay, sometimes with an explicit allowance for the time needed to determine scope and restore the system. A minority set a hard outer limit measured in days. Layered on top are sector rules with their own clocks: the health care breach rule runs on a defined outer deadline from discovery, and public companies face a securities disclosure obligation once they judge an incident material. A gap between the intrusion date and the mailing date is normal. A gap between the discovery date and the mailing date is the one to ask about.

What does a long gap usually mean in practice?

Usually that identifying whose data was in the affected system took forensic work, or that law enforcement asked for a delay, which nearly every statute permits. Sometimes it means the breached party was a vendor and the company whose name is on the envelope only learned late. That last case is common and it explains letters from organizations you have never dealt with directly. The letter should still tell you the date range. If it does not, that is your first question, because the answer determines how far back you need to look at your own accounts.

The questions that get a real answer

What do you ask when you call the number on the letter?

Four things, in order. Was my Social Security number among the elements involved for me specifically, yes or no. What is the date range of unauthorized access. Was the affected system yours or a service provider's. And which state attorney general received the sample notice, since many states publish those filings and the public copy sometimes carries more detail than the mailed version. Ask them to note the call reference number and repeat it back. A representative who can answer the first two questions from your record is reading a real file.

What does a poor answer sound like?

Any restatement of the letter you are holding. If you ask whether your Social Security number was involved and hear that the incident involved certain categories of personal information, that is the script, not an answer, and the correct response is to ask whether the record is element-specific for your account and, if the answer is no, to ask when it will be. Also treat as a non-answer any suggestion that enrolling in the offered monitoring will tell you. It will not. Monitoring reports what happens next; it says nothing about what was taken.

What the monitoring offer is doing, and what to do beside it

Should people enroll?

Enroll, because it costs nothing and the enrollment code usually expires, but do not treat it as the protection. A few states require an offer of credit monitoring for a set period when Social Security numbers are involved, and elsewhere it is voluntary and offered because it is cheaper than the alternative. The stronger step is a security freeze at each of the three nationwide credit bureaus, which is free by federal law, and which stops new accounts rather than reporting them afterward. The Federal Trade Commission oversees consumer protection in this area and maintains the government's identity theft recovery process for anyone who finds an account they did not open.

Anything you wish more recipients did?

Keep the letter. Not a photograph of it, the paper. If something surfaces two years out, the letter establishes that a specific organization held specific categories of your data on a specific date, and that single page turns a difficult dispute with a lender or a debt collector into a short one. It also becomes your proof of class membership if litigation follows, which it frequently does. The people who come through these incidents with the least trouble are the ones who filed the notice, froze their credit that week, and then let the monitoring do the routine watching.

The pattern she describes holds across incidents: the letter tells you the categories because a statute made it, and stays quiet elsewhere because nothing made it speak. Knowing which is which turns a vague document into a short list of things to confirm on one phone call.