Handling a Breach Letter for Someone Else? The Address on the Envelope Decides What They're Owed

Two letters arrive from the same company in the same week, one addressed to a parent in Hartford and one forwarded from a sibling in Phoenix, and they do not say the same thing. The dates match, the incident is identical, the paragraph describing what happened is word for word the same, and yet one offers two years of credit monitoring while the other offers one, and one names a state office you can complain to while the other does not. That difference is not an error or a negotiating position. It is the law of the recipient's state showing through the page.

The letter has at least four authors, and none of them is the company

Someone acting on another person's behalf tends to read a breach notice as a single corporate voice, which makes the hedging and the vagueness feel like evasion. It is usually assembly. Outside privacy counsel writes the body, working from a matrix of state statutes and drafting to the strictest rule that applies to anyone on the mailing list. A forensic incident response firm supplies the exposure window, which is why the dates are narrow and oddly specific. A notification vendor handles printing, address hygiene and the enrollment portal. The company itself often contributes only the apology and the phone number, and the phone number frequently rings at a call center staffed by the vendor.

Knowing that changes what you ask and whom you ask. The call center can confirm which data elements were associated with a particular record, because that is in the file it was given, and it can reissue an enrollment code. It cannot tell you why the investigation took eleven weeks, and it has no authority to extend an offer. Questions of substance go in writing to the address or email in the notice, which routes to counsel, and counsel answers the ones a regulator might later ask about.

Residence governs, not headquarters

Every state has a data breach notification statute, and the one that applies to a given person is the one covering where that person lives. A company based in Delaware notifying a retiree in Oregon follows Oregon's rules for that letter. This is the single most useful fact for anyone managing mail for a parent, a client or an estate, because it tells you where to look for the entitlement that was not mentioned. The statutes diverge on several points that matter in practice: whether notice is due within a fixed number of days or merely without unreasonable delay, whether the state attorney general must receive a copy once the affected count passes a threshold, what counts as personal information in the first place, and whether identity theft protection services must be offered when Social Security numbers are involved.

That last point explains the mismatched offers. A small number of states require a set term of monitoring when certain identifiers are exposed, and companies generally extend the required term only to residents who are owed it. Several states have also widened the definition of covered data in recent years to take in biometric records, passport numbers, taxpayer identification numbers and online account credentials with their security questions. The same incident can therefore be a notifiable breach in one state and not in the next one over, which is worth remembering if a household member in another state insists they heard nothing.

The fuller version is often already public

Where a statute requires the attorney general to be copied, that office keeps the filing, and a number of states publish a searchable list of breach notices with the sample letter attached. The sample is frequently more detailed than the mailed version, because it is accompanied by a cover letter stating the number of residents affected and the categories of data involved. For someone trying to decide whether a relative's exposure justifies freezing credit at all three bureaus or just watching the mail, that cover letter is the better document. State consumer protection divisions also field complaints when a notice seems late or incomplete, and they are the right destination for that concern rather than the company.

Health information takes a different path. A breach at a provider, a health plan or a business associate runs through federal rules administered by the Department of Health and Human Services, with its own timing and its own public posting of larger incidents, and state law often sits alongside rather than instead of it. If the letter came from a hospital system, a billing company or a plan administrator, say so when you call, because the obligations and the reporting trail are not the ones described above.

What you control without anyone's permission

The monitoring offer is a contract term the company bought, with an enrollment deadline that is the vendor's, not the state's, and letting it lapse forfeits nothing you were legally owed. A security freeze is different. Freezing and unfreezing a credit file at each of the three nationwide bureaus is free for everyone, as is placing one for a minor or for an adult whose affairs you manage under a power of attorney, though the bureaus will each want documentation of that authority and will want it in their own format. Do one bureau at a time and keep the PINs where the person you are helping can also reach them.

The Federal Trade Commission is responsible for federal identity theft recovery resources and maintains the process for building a recovery plan and an identity theft report if misuse actually appears. That report, not the breach letter, is what creditors and collectors respond to. Keep the original notice anyway, with the envelope and its postmark, in the same folder as any freeze confirmations and the enrollment code.

The practical sequence is short. Establish which state's law governs the recipient, check that state's published breach filings for the fuller account, freeze the credit file regardless of what the offer says, and only then decide whether the monitoring is worth enrolling in. A few lines in a letter are doing the work of a statute, and reading them in that light tells you which questions have an answer waiting.