How to Read a Data Breach Notification Letter

If a company just sent you a data breach notification letter, the first instinct is usually confusion — is this real, is it urgent, what am I actually supposed to do? This guide walks through what these letters legally have to include, what each section means, and how to confirm the letter matches an actual filing before you act on it.

What a Data Breach Notification Letter Actually Is

A data breach notification letter is a legally required notice a company sends when your personal information was exposed in a security incident. Most states require companies to notify both affected individuals and the state Attorney General's office — which is why these letters usually reference a specific filing date and state.

This is not a marketing email and not a scam attempt by default — though scammers do sometimes impersonate real breach notices, which is exactly why verifying the letter matters (see the last section below).

The 5 Things Every Notice Letter Should Tell You

Most state laws require these letters to include specific information. If a letter you received is missing several of these, that's worth noticing:

1. What happened

A description of the security incident — how the exposure occurred, whether it was a hack, an employee error, or a vendor breach.

2. What information was involved

Exactly which categories of your data were exposed — for example, Social Security number, financial account number, medical record information, or login credentials. This matters because your next steps depend heavily on what was exposed. A password leak calls for different action than an SSN leak.

3. When it happened and when it was discovered

Companies are often required to disclose both the date of the breach and the date they discovered it — and sometimes there's a meaningful gap between the two, which can be legally relevant.

4. What the company is doing about it

Many letters offer free credit monitoring or identity theft protection for a set period (commonly 1–2 years). This is worth taking advantage of — it typically costs you nothing to enroll.

5. What you can do

Recommended steps like placing a fraud alert, freezing your credit, or monitoring your accounts.

What To Do After You've Read It

Verify it's legitimate (see below) before clicking any links in the letter or calling any phone number it provides — verify independently instead.
Enroll in any free monitoring offered, if you're comfortable doing so.
Consider a credit freeze with the three major credit bureaus (Equifax, Experian, TransUnion) if Social Security numbers or financial account data were exposed.
Keep the letter. Don't discard it — it's your documentation that you were an affected individual, which matters if you later want to understand your legal options.
Watch your accounts for unusual activity in the months following, not just immediately.

How to Confirm the Letter Is Real

Because breach notices reference real incidents, scammers sometimes send fake versions designed to look like a legitimate notice in order to phish for more information. The safest way to check: cross-reference the company name in your letter against the actual state Attorney General filing — not against a link or phone number provided in the letter itself.

Search our free breach registry → to check the company name from your letter against our database of official state AG filings, updated daily. If the company appears there with a matching filing date, the letter is real.

Frequently Asked Questions

Do I have to respond to a data breach notification letter?

No — there's typically no required action on your part. The letter is informational and protective, not something requiring a signature or response. That said, taking the protective steps above (credit freeze, password changes, account monitoring) is strongly advisable.

Does receiving this letter mean I'll be a victim of identity theft?

Not necessarily. It means your data was exposed, which raises the risk — it doesn't guarantee misuse will occur. That said, the type of data exposed (especially SSNs or financial account numbers) affects how seriously to take precautions. Act as though the data is in the wrong hands, even if you haven't seen fraud yet.

Can I do anything legally if my data was exposed?

Depending on the breach and what was exposed, affected individuals sometimes have legal options, including participating in a class action lawsuit. Get a free case review → to find out if you may have options for your specific situation. There is no cost to you unless we recover compensation on your behalf.