Reporting that starts where the advice runs out.
| Author | Constance Marlowe |
|---|---|
| Section | Innovation |
| Filed | |
| Reading | 5 min |
A first breach notification usually arrives from a vendor you never hired, months after the fact, and the month it lands decides which step comes first.
The envelope is thin, the return address belongs to a claims administrator in a state you have never lived in, and the first paragraph refers to an incident that happened in June. It is December. Nobody explains, in the letter, why a company you have no account with is writing to you about your Social Security number, or why it took six months, or why the enrollment code expires in ninety days. All three of those facts have the same origin, which is the way breach notification law was assembled over twenty years, one state at a time. Understanding that origin tells you what to do first.
Follow the subcontract and the strange return address stops being strange. When you gave your information to a hospital, an employer, or an insurer, that organization kept the legal role of data owner, and then handed operational work to somebody else: a billing processor, a benefits administrator, a document scanning firm, a file transfer service used by hundreds of clients at once. State statutes generally split the duty in two. The vendor that merely maintains the data owes notice to the owner. The owner owes notice to you. So the breach happens inside a company you have never heard of, travels up the chain to the client whose customer you actually are, and then comes back down under whichever name the parties agreed would sign the letter.
That structure explains the delay as much as the letterhead does. A processor that serves many clients has to determine whose records were in the affected system, which is file-by-file work, and each client then has to decide independently whether its own state's threshold has been crossed. Some of the waiting is genuinely the process. Some of it is a vendor's counsel and a client's counsel negotiating who signs and who pays for the monitoring offer, and that part can add weeks with nothing happening on your file at all.
Breach notification is a state invention, not a federal one. California passed the first general law in 2003, requiring disclosure in the most expedient time possible and without unreasonable delay, with an exception for law enforcement that asks for quiet while it investigates. Other states copied the idea and then improved on it in incompatible ways over the following fifteen years, until every state had something. Many of the later statutes replaced the elastic standard with a hard count of days, commonly thirty, forty-five, or sixty, running from the point the organization determines a breach occurred rather than from the day it happened. That second clause is where the months go. Discovery, forensic confirmation, and determination are three separate dates, and only the last one starts the clock.
The Federal Trade Commission oversees identity theft reporting and remediation for consumers, and it is the body most people are eventually pointed toward, but the notice itself is a creature of state law. That is also why the letter reads the way it does, with the categories of information listed flatly and no real narrative: the drafter is satisfying the content requirements of several statutes at once, and anything beyond those requirements is an admission somebody's attorney would rather not make. Read it as a compliance document and it becomes much easier to extract what you need.
A letter in July and the same letter in December are not the same event, because the exposure of a Social Security number is a tax problem before it is a credit problem. The IRS opens filing season in late January, and a fraudulent return filed with your number and a stranger's bank account gets processed on a first-come basis. The defense exists and it is free: an Identity Protection PIN, which you request from the IRS and which makes an electronic return filed without it rejectable. Requesting one in early January costs an evening. Discovering in March that a return was already filed under your number costs a paper filing, an affidavit, and a wait measured in months rather than weeks.
Winter timing has two other effects worth planning around. The complimentary monitoring offer runs on a fixed enrollment window from the letter date, which in a December notice means the deadline falls during the weeks when nobody is opening mail carefully, and an unused code simply expires. And if you are going to apply for a mortgage, refinance, or auto loan in spring, a credit freeze placed now has to be lifted before the lender pulls, which takes an hour online if you still have the PINs and considerably longer if you do not. Placing the freeze in January and writing the PINs somewhere you will find them in April is the version of this that does not cause a problem.
Freeze first, because it is free at all three bureaus, it is reversible, and it blocks the most common downstream use of a stolen identity file. Then the IRS PIN, before filing season opens, and before you have your W-2 in hand, since the two are unrelated. Then enroll in the monitoring, not because the product is remarkable but because the code expires and enrolling preserves the option. Then keep the letter. It is dated evidence that your information was exposed on a particular date by a particular organization, and if a fraudulent account or return surfaces two years from now, that letter is what turns a dispute you have to argue into a dispute you can document.
One more step that first-timers skip: note which company signed the letter and which one the breach actually happened at, because they are rarely the same and the distinction matters if you later need to ask questions. The signer is the entity with the duty to you. The vendor is the one that knows what happened. Correspondence addressed to the signer, referencing the incident date and your notification reference number, gets answered. Correspondence to the vendor usually does not, because you were never their customer.
The timeline that produced your letter was built by legislatures reacting to each other over two decades, and the chain that delivered it was built by contracts you never saw. Neither is going to change because you noticed. What you control is the fortnight after the envelope arrives, and in December that fortnight is worth more than the same fortnight in June, because the filing season deadline is the one that actually cannot be reopened.