Walk It Through: The Breach Letter

Without unreasonable delay, the Attorney General above 1,000, and a penalty per breach.

A letter arrives saying a lender's systems were breached and account numbers were taken.

Two things a person in this spot might do. Picking one shows what the law says about it.

One breach letter from one lender. What counts as personal information, the forms notice may take, and the exception for encrypted data are not worked through here.

A practice walkthrough, not a prediction of how any real one will go. Legal information, not legal advice.

Words this turns on

Terms with a legal meaning that is narrower than the everyday one. Each links to the definition and the authority behind it.

Breach of the security of the systemAccess and acquisition by an unauthorized person of unencrypted or unredacted personal information that causes or is reasonably believed to cause identity theft or another fraud to a resident. The owner or licensee discloses it to affected residents without unreasonable delay, and the Office of the Attorney General is told too when more than 1,000 persons are notified at one time.