Data Breach Notice Explained: What Your Letter Means

A data breach notice is written to meet legal requirements, and it reads that way. Most follow the same pattern, use the same careful phrases, and leave out the details you most want to know. Read closely, though, a data breach notice tells you exactly what you need to decide your next steps.

The short answer: a data breach notice tells you what happened, which types of your information were involved, when it happened, what the organization is doing, what it suggests you do, and how to reach it. It usually doesn’t tell you who was behind the breach, whether your information has actually been misused, or whether anyone has sued.

If you’re not yet sure the letter is genuine, start with our guide on how to verify a data breach letter. This article assumes the notice is real and explains how to read it.

Key takeaways

A breach notice tells you what the organization knows and is required to share: what happened, what information was involved, when, and what you can do.
The most useful line is “What Information Was Involved.” Your next steps depend on it.
Phrases like “may have been accessed” and “no evidence of misuse” describe what the organization can confirm, not a guarantee of safety.
Notices usually don’t say who was behind the breach, whether your data was misused, or whether a lawsuit exists.
Keep the notice. Its dates, activation codes, and contact details matter later.

Why data breach notices all look alike

Breach notices follow state laws, and the laws overlap. California’s is the most prescriptive. A notice to California residents must be titled “Notice of Data Breach” and organized under the headings “What Happened?” “What Information Was Involved?” “What We Are Doing,” “What You Can Do,” and “For More Information” (Cal. Civ. Code § 1798.82). Many organizations use the same structure for everyone they notify.

Health information follows a federal rule. Under HIPAA, a notice must include, to the extent possible, a brief description of the breach, the types of information involved, the steps people should take to protect themselves, what the organization is doing, and contact information (HHS).

That shared structure is useful. Once you know what each section is for, you can read any data breach notice in a few minutes.

Reading a data breach notice, section by section

“What Happened”

This section describes the incident in general terms: unauthorized access to a network, a compromised email account, a stolen device, or a breach at a vendor. Look for three things: whether the breach happened at the organization itself or at a company working for it, whether the system was accessed or files were actually taken, and whether the incident is described as contained.

Expect it to be brief. Organizations often limit detail while an investigation or law enforcement inquiry continues.

“What Information Was Involved”

This is the most important part of the notice. It lists the types of personal information involved, such as your name with your Social Security number, driver’s license number, financial account number, medical information, or health insurance information. California law defines which combinations count as personal information, including a username or email address combined with a password or security question that would allow access to an online account (Cal. Civ. Code § 1798.82).

Read this list item by item, because your next steps depend on what’s on it. The table below shows how.

The dates

A notice may include several dates: when the breach happened, when it was discovered, and when the notice was sent. California requires the date or estimated date range of the breach, if known, and the date of the notice. The gap between them often explains why the letter arrived months later.

“What We Are Doing”

This section describes the organization’s response: securing systems, hiring investigators, notifying law enforcement, and offering services. Under California law, when a breach exposed a Social Security number, driver’s license, or California ID number and the notifying business was the source of the breach, the notice must include an offer of identity theft prevention and mitigation services, if any, at no cost for at least 12 months (Cal. Civ. Code § 1798.82).

“What You Can Do”

Expect general advice: watch your account statements, review your credit reports, consider a credit freeze or fraud alert, and enroll in any offered service. When a Social Security number or driver’s license number is involved, California requires the notice to list the toll-free numbers and addresses of the major credit reporting agencies.

“For More Information”

This section gives a call center number, website, or mailing address, plus any reference or activation code. Keep this section. Before you use the contact details, confirm them with the organization’s official website, as explained in our verification guide.

What each type of exposed information means for you

The FTC lists ways identity thieves use stolen information, including to “get new credit cards in your name,” “steal your tax refund,” and “get medical care” (FTC). Here is how that maps to the items a notice may list.

If the notice lists…	The main risk	First steps
Social Security number	New accounts opened in your name; tax refund fraud	Check credit reports; consider a credit freeze or fraud alert; file taxes early
Financial account or card number (with a code or password)	Unauthorized charges or withdrawals	Contact your bank or card issuer; review transactions
Username or email with password	Someone taking over the account, or others where you reused the password	Change the password everywhere you used it
Medical or health insurance information	Someone using your coverage for care, drugs, or claims	Review explanation of benefits statements and medical records for services you didn’t get
Driver’s license or other government ID number	Someone posing as you	Follow the notice’s guidance; credit bureau contacts must be included in California notices

Sources for these steps: the FTC’s Data Breaches: What to Know, What to Do and its guidance on medical identity theft, which suggests reviewing explanation of benefits statements for services you didn’t get. To compare protections for your credit, see our guide on choosing a credit freeze or fraud alert.

Common phrases, decoded

Breach notices are drafted carefully, and some phrases are easy to misread. Here is what the most common ones usually mean.

Common breach notice phrases and what they mean
When the notice says…	What it usually means
“Security incident”	A neutral term organizations often use in early statements. If you received a formal notice, the organization has concluded that notice was required.
“Accessed or acquired” / “may have been”	The organization can’t rule out that someone obtained the information. Many state laws require notice when information was acquired or is reasonably believed to have been.
“No evidence that your information has been misused”	The organization hasn’t seen misuse so far. It doesn’t mean misuse can’t happen later.
“Out of an abundance of caution”	A common phrase that doesn’t change your situation. Focus on which information was involved.
“Files that contained your information”	Your data was in the affected files. It may not say whether those specific records were viewed or copied.
“A third-party vendor” or “service provider”	The breach happened at a company holding data for the organization you know, such as a payroll, billing, or software provider.
“The information was encrypted”	Encrypted data is generally unreadable without the key. Check whether the notice says the key or credentials were also taken.

On encryption: California’s law covers unencrypted personal information. It also reaches encrypted information when the encryption key or credentials were taken and could make the data readable (Cal. Civ. Code § 1798.82).

What a data breach notice usually doesn’t tell you

Who was responsible. Notices rarely name the attacker or say whether a ransom was demanded.
Whether your information has been misused. A notice confirms exposure, not misuse. Only your own credit reports, statements, and account activity can show that.
How many people were affected. Some regulators publish this. The Washington attorney general’s directory lists the number of Washington residents affected by each reported breach (Washington AG).
Whether a lawsuit or settlement exists. A breach notice is not a legal claim. A lawsuit may follow or may not, and a settlement exists only if a court approves one. Our lawsuits and settlements [ADD LINK LATER → /lawsuits-and-settlements/] coverage tracks verified cases.

To learn more about a specific incident, check the official breach lists described in our verification guide, a public company’s SEC filings, or our Breach Notice Tracker.

Why the notice arrived when it did

Deadlines usually run from when a breach is discovered, not when it happened, and investigations take time to identify who was affected.

California requires notice within 30 calendar days of discovering or being notified of a breach, with delays allowed for law enforcement needs or to determine the breach’s scope and restore system integrity (Cal. Civ. Code § 1798.82).
Washington requires notice within 30 calendar days after the breach was discovered, with similar exceptions (RCW 19.255.010).
HIPAA requires notice to individuals without unreasonable delay and no later than 60 days after discovery (HHS).

Why some notices come by email, or not at all

HIPAA notices go by first-class mail unless you have agreed to receive them electronically (HHS). California allows an electronic notice when only online login credentials were exposed, directing people to change their password and security questions (Cal. Civ. Code § 1798.82).

When notifying everyone individually would be impractical, California allows “substitute notice”: email where available, a website posting for at least 30 days, and notice to major statewide media. It applies when notice would cost more than $250,000, more than 500,000 people are affected, or contact information is insufficient. That is why you may learn about a breach from the news or the organization’s website before, or instead of, a letter.

What to do after you read the notice

Confirm it’s real, if you haven’t already, using our guide to verifying a data breach letter.
Underline the information types listed under “What Information Was Involved” and match them to the table above.
Note any enrollment deadline and activation code for offered services, and read the service terms before enrolling.
Check your credit reports, free weekly at AnnualCreditReport.com (FTC).
Keep the notice and any related emails or call notes. Our Digital Evidence Checklist explains what to save.

If you find accounts, charges, or tax filings you don’t recognize, follow our first steps after identity theft and report it at IdentityTheft.gov.

Frequently asked questions

What does “no evidence of misuse” mean in a data breach notice?

It means the organization hasn’t seen your information being misused so far. It isn’t a guarantee. Keep checking your credit reports and account statements.

What does “out of an abundance of caution” mean?

It’s a common phrase in breach notices and doesn’t change your situation. Focus on which types of information the notice says were involved.

Why doesn’t my data breach notice say how many people were affected?

Notices to individuals usually don’t include it. Some state regulators publish counts, such as the Washington attorney general’s breach directory.

Do I have to sign up for the credit monitoring offered in the notice?

No. It’s optional. If you want it, confirm the offer with the organization first, note the enrollment deadline, and read the terms before enrolling.

Why did I get my data breach notice by email?

Some laws allow electronic notice in certain cases, such as when only login credentials were exposed, or when you agreed to electronic notices. Verify the email before clicking anything in it.

Does a data breach notice mean there’s a lawsuit?

No. A breach notice is not a legal claim. A lawsuit may or may not be filed, and a settlement exists only if a court approves one.

Sources

This article is general information, not legal advice. Laws differ by state and change over time. Read how we research and update our work in our Editorial Standards, and see our Corrections Policy to report an error. More coverage: Data Breaches.

The Cyber Law Brief

Get practical guides like this in your inbox

Weekly reporting. No noise. Unsubscribe anytime. Privacy Policy.

Breach Notices: What the Letter Actually Tells You

Why data breach notices all look alike