Data Breach Notice to Residents and State Authorities in Missouri

At a glance

Requirements one by one

Covered information and risk screen

Mo. Rev. Stat. § 407.1500.1(1) defines a breach as unauthorized access to and acquisition of computerized personal information that compromises its security, confidentiality, or integrity. The covered combinations in subsection 1(9) include a name with a Social Security or government ID number, financial-access information, medical information, or health-insurance information.

Under § 407.1500.2(5), notice is unnecessary if an appropriate investigation or law-enforcement consultation supports a finding that identity theft or other fraud is not reasonably likely. The finding must be written and kept for five years.

Who gets notice, and when

The owner or licensor notifies an affected Missouri consumer without unreasonable delay under § 407.1500.2(1). Contact tracing, incident scope, system restoration, and the stated law-enforcement delay can affect timing; the section gives no fixed outside day count. A nonowner custodian notifies the owner or licensor immediately after discovering a breach under subsection 2(2).

When more than 1,000 consumers are notified at one time, § 407.1500.2(8) also requires notice without unreasonable delay to the Attorney General's office and all nationwide consumer reporting agencies. The report covers the timing, distribution, and content of resident notices.

Resident content and substitute delivery

Section 407.1500.2(4) calls for a general incident description, the type of information obtained, an available assistance telephone number, consumer-reporting-agency contacts, and advice to review account statements and free credit reports. Direct methods are writing, qualifying consented email, or a live telephone call.

Substitute notice under § 407.1500.2(6)-(7) is available above $100,000 in notice cost or 150,000 affected consumers, or for consumers lacking adequate contact or consent or who cannot be identified. The last two routes apply only to those consumers. The notice uses email where available, a website post if the entity has a site, and major statewide media.

What trips people up

A police delay must be recorded. Under § 407.1500.2(3), law enforcement must advise that notice may impede a criminal investigation or jeopardize national or homeland security. The request must be written or contemporaneously documented with the officer's name and agency; notice resumes without unreasonable delay after clearance.

Insurance licensees may have a faster regulator clock. Effective January 1, 2026, § 375.1410.1 gives a qualifying insurance licensee no more than four business days after determining a covered cybersecurity event to notify the insurance director. Subsection 3 still directs compliance with § 407.1500 where applicable.

Policy routes have conditions. Section 407.1500.3 recognizes consistent own-policy, regulator, and specified financial-institution notice procedures; an internal policy alone does not erase the timing requirement.

Common questions

Is every exposed record a reportable breach?

Section 407.1500.1(1) requires unauthorized access and acquisition of the covered computerized information; subsection 2(5) separately permits a documented no-notice determination when fraud risk is not reasonably likely.

Must every breach go to the Attorney General's office?

The general § 407.1500.2(8) report starts when more than 1,000 consumers are notified at one time. Insurance licensees must also consider the separate § 375.1410 director report.

Statutes and sources

• Mo. Rev. Stat. § 407.1500 — general private-entity breach notice.
• Mo. Rev. Stat. § 375.1410 — qualifying insurance-licensee regulator notice.

Current official text accessed October 14, 2026.