Alaska Data Breach Notification Package
(Prepared for Immediate Attorney Review & Customization)
[// GUIDANCE: This package contains two coordinated templates—(i) a notice to the Alaska Attorney General and (ii) a notice to affected Alaska residents. Both comply with Alaska Stat. § 45.48.010 et seq. Insert all bracketed placeholders before release. If more than 1,000 residents will be notified, you must also provide notice to the nationwide consumer reporting agencies. Timing: deliver “without unreasonable delay” after discovery, subject to law-enforcement holds and internal containment measures. Retain proof of transmittal for at least five (5) years.]
Table of Contents
- Attorney General Notice Template
- Consumer Notice Template
- Optional Substitute Notice (summary)
- Statutory Reference Sheet
1. Attorney General Notice Template
(Use when Alaska residents are affected; deliver via email and hard copy to the addresses provided.)
[COMPANY LETTERHEAD]
[Date]
Via [E-Mail / Certified Mail / Overnight Courier]
Hon. Treg R. Taylor
Office of the Alaska Attorney General
ATTN: Consumer Protection Unit – Data Breach Notifications
1031 W. 4th Avenue, Suite 200
Anchorage, Alaska 99501-1994
E-mail: [email protected]
Re: Notice of Data Breach Pursuant to Alaska Stat. § 45.48.010
Dear Attorney General Taylor:
[Company Name] (“Company”) provides this notice regarding a data security incident that may have exposed the personal information of Alaska residents.
-
Nature of the Incident
On [Date of Discovery], Company identified [brief, factual description of incident—e.g., “unauthorized access to an employee e-mail account”]. -
Incident Timeline
• Date(s) of incident: [Insert]
• Date of discovery: [Insert]
• Date containment completed: [Insert]
• Date forensic investigation concluded: [Insert] -
Categories of Personal Information Involved
The incident potentially involved the following data elements, as defined in Alaska Stat. § 45.48.090(9):
☐ Social Security numbers
☐ Driver’s license / state ID numbers
☐ Financial account numbers with access codes
☐ [Other] -
Number of Impacted Individuals
• Alaska residents: [###]
• Total individuals (all jurisdictions): [###] -
Consumer Notification
Written notice will be mailed beginning on [MM/DD/YYYY] and is expected to conclude by [MM/DD/YYYY], consistent with the statutory obligation to notify without unreasonable delay. -
Steps Taken to Address the Incident
• Engaged independent cybersecurity firm on [Date].
• Implemented multi-factor authentication.
• Offering [12/24] months of complimentary credit monitoring and identity-theft insurance to affected individuals. -
Contact Information
For additional information, please contact [Name], [Title], at [Phone] or [E-mail].
Company remains committed to protecting the privacy of Alaska residents and to complying with all applicable laws and regulations.
Respectfully submitted,
[Authorized Signatory]
[Title]
[Company Name]
[Address]
[Telephone]
[E-mail]
[// GUIDANCE: Attach a copy of the consumer notice (Section 2) for AG review. Retain a signed copy in the incident response file.]
2. Consumer Notice Template
(Alaska Resident – Written Notice)
[COMPANY LETTERHEAD]
[Date]
Notice of Data Breach
Dear [First Name] [Last Name]:
We are writing to inform you of a data security incident that may have involved your personal information. We take this matter seriously and are providing details, steps we are taking, and resources available to help you protect yourself.
What Happened?
On [Incident Date(s)], we discovered [brief, plain-language explanation of incident]. Our investigation determined that unauthorized access occurred between [Date] and [Date].
What Information Was Involved?
The information may have included your:
☐ Name
☐ Social Security number
☐ Driver’s license or state identification number
☐ Financial account number and accompanying access information
☐ [Other]
What We Are Doing.
• Immediately secured the involved systems and engaged a leading cybersecurity firm.
• Notified law enforcement and relevant regulatory authorities.
• Offering you [12/24] months of complimentary credit monitoring and identity theft protection through [Provider Name]. To activate, visit [URL] and use code [CODE] by [Deadline].
What You Can Do.
We recommend that you:
1. Enroll in the complimentary credit-monitoring service.
2. Review your credit reports and account statements for unauthorized activity.
3. Consider placing a fraud alert or security freeze on your credit files. Under Alaska law, you may obtain a security freeze free of charge.
Contact Information for the Three Nationwide Consumer Reporting Agencies
• Equifax – 1-800-685-1111 – www.equifax.com
• Experian – 1-888-397-3742 – www.experian.com
• TransUnion – 1-800-680-7289 – www.transunion.com
Federal Trade Commission
You may obtain additional information about identity theft from the FTC at www.identitytheft.gov or 1-877-ID-THEFT (438-4338).
For More Information.
If you have questions, please call our dedicated toll-free hotline at [###-###-####] Monday through Friday, [X a.m.–X p.m.] Alaska Time, or e-mail us at [E-mail]. You may also write to us at:
[Company Name]
[Address]
Attn: Privacy Office
We regret any concern this incident may cause and remain committed to safeguarding your information.
Sincerely,
[Authorized Signatory]
[Title]
[Company Name]
[// GUIDANCE: Alaska allows e-mail notice only if the consumer has consented to receive electronic communications. Retain mailing logs or electronic delivery receipts for defensibility.]
3. Optional Substitute Notice (Summary)
(Use only if written/e-mail notice is impracticable AND the incident meets the statutory cost or population thresholds.)
- E-mail notice (if address available).
- Conspicuous posting on Company’s home page for at least 30 days.
- Statewide Alaska media publication.
[// GUIDANCE: See Alaska Stat. § 45.48.010(e) for specific conditions.]
4. Statutory Reference Sheet
• Alaska Stat. § 45.48.010 – .090 (Personal Information Protection Act)
• Alaska Stat. § 45.48.010(a) – Consumer notification requirement
• Alaska Stat. § 45.48.010(f) – Timing (“without unreasonable delay”)
• Alaska Stat. § 45.48.010(k) – Notice to consumer reporting agencies when >1,000 persons are notified
[// GUIDANCE: Citations above are limited to well-established statutory sections in compliance with the Citation Policy.]