By David S. Harris, Esq. · 8 min read
A notice is worth reading closely—before you click a link, call a number, or make a decision.
If a company sent you a data breach notification letter, it is normal to have questions: Is this real? Is it urgent? What am I supposed to do? This guide explains the important parts of a typical notice and how to confirm it relates to an actual reported incident.
Start here
What a data breach notification letter actually is
A data breach notification letter is a notice a company sends when personal information may have been exposed in a security incident. State laws often require organizations to notify affected individuals and, in many circumstances, a state Attorney General or other regulator.
That does not mean every notice is automatically trustworthy—scammers sometimes imitate real incidents. It does mean a genuine letter should provide enough detail for you to check it independently, without relying on a link or phone number printed in the message.
Read the details
The 5 things every notice letter should tell you
Requirements vary by state and situation, but a useful breach notice typically explains the incident, affected information, relevant dates, the company’s response, and practical steps for you.
- 01
What happened
The notice should describe the security incident and how the exposure occurred. It may identify a cyberattack, a lost device, an employee error, or an incident involving a service provider.
- 02
What information was involved
Look for the specific categories of information affected, such as a Social Security number, financial account number, medical information, or login credentials. The type of information involved should guide your next steps.
- 03
When it happened and was discovered
A notice may identify both the incident date and the date the organization discovered it. Keep those dates with the letter, particularly if the incident involved sensitive information.
- 04
What the company is doing
Many notices offer credit monitoring or identity-theft protection for a defined period. Check the enrollment deadline and read the terms before deciding whether to use the service.
- 05
What you can do
The notice may recommend monitoring accounts, changing passwords, placing a fraud alert, or freezing credit. Recommendations should be considered alongside the specific information that was exposed.
Keep control
What to do after you have read it
- Verify first. Confirm the incident independently before clicking a link in the letter or calling a number it provides.
- Consider the monitoring offer. If the company offers free credit or identity monitoring, review the terms and any enrollment date before deciding whether to enroll.
- Protect sensitive information. A credit freeze may be worth considering if a Social Security number or financial-account information was involved. Monitor financial accounts for unfamiliar activity.
- Keep the letter. Save the notice and envelope with your records. It documents that you were notified and may contain important dates or enrollment information.
Verify independently
How to confirm the letter is real
Search the company name from your letter against reported breach case files, then compare the company, state, and timing with the notice you received. Use an independently found company website or customer-service number if you need additional confirmation—rather than a link or number in an unexpected message.
Verify my letterFrequently asked questions
Do I have to respond to a data breach notification letter?+
Usually, no. A breach notification letter is generally informational and protective; it does not ordinarily require a signature or response. Read it promptly so you do not miss an enrollment deadline for any offered service.
Does receiving a letter mean I will become a victim of identity theft?+
Not necessarily. A notice means data may have been exposed, which can raise the risk of misuse. It does not guarantee that misuse will occur. The information involved—especially Social Security numbers or financial account information—can affect which precautions make sense.
Can I do anything legally if my information was exposed?+
Depending on the incident and the information involved, affected individuals may have legal options, including a class action. A breach notice alone does not establish eligibility or guarantee compensation, but it can be useful documentation when discussing your situation.
Related guides