The envelope is usually white, the paper is usually heavy, and the first paragraph almost always begins by telling you how seriously the company takes your privacy. Then there is a sentence with the words "may have been accessed by an unauthorized third party." Then a phone number, an enrollment code, and a page of general advice about watching your statements.
That sameness is not laziness. It is the shape of a legal requirement, and once you know which pieces the law forces onto the page, you can skip past them and find the three or four facts that actually tell you what happened to your information and how long it will matter.
The letter is a compliance document before it is a warning
Before the early 2000s, a company that lost a file of customer records had no general obligation to tell the customers. Nothing required it. Many never found out.
California changed that with a notification law that took effect in 2003. The idea was narrow and practical: if a company loses unencrypted personal information about a resident of the state, it has to say so, in writing, without unreasonable delay. Other states copied it, then amended their copies. Over the following two decades every state ended up with some version, which is why a company headquartered in one state sends essentially the same letter to customers in all of them. Writing fifty different letters is harder than writing one that satisfies the strictest.
Layered on top are sector rules. Health information carries its own federal notification requirement, which is why a letter from a hospital billing contractor reads slightly differently and often mentions a federal agency by name. Banks and insurers have their own regulators with their own expectations.
The practical result for a household is this. The letter was drafted by attorneys whose job was to satisfy a patchwork of statutes without creating evidence that could be used against the company later. The warm opening paragraph is risk management. The list of what was taken is the statute talking. That list is the part written for you.
Three dates, and the gap between them
Most notices contain a date the incident is believed to have occurred, a date the company discovered it, and a date the letter was sent. Sometimes the first is a range. Sometimes it is missing entirely, which is itself informative.
Start with the gap between occurrence and discovery. If an intrusion ran from March to September and was found in November, your data was out of the building for the better part of a year before anyone knew. That tells you nothing about the company's intentions and everything about the practical reality: whoever took the information has had it, sorted it, and probably sold it on before you heard a word.
Then look at the gap between discovery and mailing. State laws generally require notice without unreasonable delay, and many set an outer limit measured in days, with a carve-out allowing law enforcement to ask for a hold while an investigation runs. A long gap often means that carve-out was used. It is not a scandal. It does mean the clock you are starting is not the clock the attacker is on.
The third date to find is the one buried near the end: when the free monitoring offer expires. That number was chosen by a vendor contract, not by any assessment of how long your information stays useful.
Not all stolen data ages the same way
This is where I think most households misread the letter. The instinct is to treat a breach as an event with a cleanup period. Change the password, watch the statements for a month, move on. That works for some kinds of data and not at all for others, and the difference is durability.
A payment card number has a short life. It expires, the bank reissues, the number is dead. A password is similar in principle: you can change it in a minute, and the stolen version becomes worthless the moment you do. These are the week-one failures. They are loud, they are annoying, and they are fixable.
A Social Security number does not expire. Neither does your date of birth, your mother's maiden name, the address history that sits behind identity verification questions, or the answers to the security questions you set up in 2009 about your first pet. Those are the year-eight failures. Nothing happens for a long time, the monitoring offer lapses, you forget the company's name, and then an account is opened in your name using facts that were accurate in 2019 and are still accurate now.
So read the list of compromised data types as a durability list:
- Replaceable in minutes. Passwords, security question answers, session tokens.
- Replaceable with paperwork. Card numbers, account numbers, driver's license number, in some states.
- Effectively permanent. Social Security number, date of birth, full name and address history, medical history, biometric records.
If the letter lists only items from the first group, the work is short. If it reaches the third group, the work is not more urgent, but it is much longer-lived, and it should be set up to run without your attention.
How to work it, in the order that pays off
Do the fast items first, because they close quickly and then stay closed.
- Change the password at the breached company, then anywhere you reused it. Reuse is what turns one company's bad week into six of your accounts. If you cannot remember where you reused it, that is a sign to move everything into a manager and stop tracking it in your head.
- Turn on two-step verification where the account holds money or controls other accounts. Email first. Email is the master key to almost everything else, because that is where reset links land.
- Place a credit freeze at each of the three nationwide credit bureaus. A freeze is free by federal law, it is separate from whatever monitoring the letter offers, and unlike monitoring it blocks new accounts rather than reporting them after the fact. The Federal Trade Commission oversees identity theft protections for consumers and maintains guidance on how freezes and recovery work.
- Take the monitoring if it is offered, but put the expiration date in a calendar. When it lapses, the freeze is what remains, which is the point.
- Keep the letter. Scan it or file it. If something surfaces in four years, a dated notice naming the data types is the cleanest proof you have that the information was out there before you did anything.
For a household rather than a single person, add one step: ask who else in the house had an account with the same company, and freeze credit for any children named in a medical or school-related breach. A child's file has no activity on it, so misuse can run for years before anyone looks.
What the format gives you
Because the letter is a compliance document, it is also a dependable one. Those categories appear because a statute says they must. That makes the notice skimmable in a way most corporate mail is not. Open it, find the dates, find the data list, and sort the contents into the three durability buckets.
The ten minutes of password work handles the part that fails immediately. The freeze handles the part that is still sitting in someone's database in year eight, waiting to be tried.