State Data Breach Notification Letter

Alaska Data Breach Notification Package

(Prepared for Immediate Attorney Review & Customization)

Table of Contents

1. Conditional Attorney General Notice Template
2. Consumer Notice Template
3. Optional Substitute Notice (summary)
4. Statutory Reference Sheet

1. Conditional Attorney General Notice Template

(Use only after counsel determines that resident notice is not required because there is no reasonable likelihood of harm. AS § 45.48.010(c) requires written notice to the Attorney General before relying on that determination. Confirm current delivery instructions with the Attorney General's office.)

[COMPANY LETTERHEAD]

[Date]

Via [E-Mail / Certified Mail / Overnight Courier]

Hon. Treg R. Taylor
Office of the Alaska Attorney General
ATTN: Consumer Protection Unit – Data Breach Notifications
1031 W. 4th Avenue, Suite 200
Anchorage, Alaska 99501-1994
E-mail: [email protected]

Re: Written Notice of No-Harm Determination Under Alaska Stat. § 45.48.010(c)

Dear Attorney General Taylor:

[Company Name] (“Company”) provides this written notice before relying on its determination under Alaska Stat. § 45.48.010(c) that resident disclosure is not required.

1. Nature of the Incident
   On [Date of Discovery], Company identified [brief, factual description of incident—e.g., “unauthorized access to an employee e-mail account”].

2. Incident Timeline
   • Date(s) of incident: [Insert]
   • Date of discovery: [Insert]
   • Date containment completed: [Insert]
   • Date forensic investigation concluded: [Insert]

3. Categories of Personal Information Involved
   The incident potentially involved the following data elements, as defined in Alaska Stat. § 45.48.090(9):
   ☐ Social Security numbers
   ☐ Driver’s license / state ID numbers
   ☐ Financial account numbers with access codes
   ☐ [Other]

4. Number of Impacted Individuals
   • Alaska residents: [###]
   • Total individuals (all jurisdictions): [###]

5. Consumer Notification
   Written notice will be mailed beginning on [MM/DD/YYYY] and is expected to conclude by [MM/DD/YYYY], consistent with the statutory obligation to notify without unreasonable delay.

6. Steps Taken to Address the Incident
   • Engaged independent cybersecurity firm on [Date].
   • Implemented multi-factor authentication.
   • Offering [12/24] months of complimentary credit monitoring and identity-theft insurance to affected individuals.

7. Contact Information
   For additional information, please contact [Name], [Title], at [Phone] or [E-mail].

Company remains committed to protecting the privacy of Alaska residents and to complying with all applicable laws and regulations.

Respectfully submitted,

____________________________________
[Authorized Signatory]
[Title]
[Company Name]
[Address]
[Telephone]
[E-mail]

2. Consumer Notice Template

(Alaska Resident – Written Notice)

[COMPANY LETTERHEAD]

[Date]

Notice of Data Breach

Dear [First Name] [Last Name]:

We are writing to inform you of a data security incident that may have involved your personal information.  We take this matter seriously and are providing details, steps we are taking, and resources available to help you protect yourself.

What Happened?
On [Incident Date(s)], we discovered [brief, plain-language explanation of incident].  Our investigation determined that unauthorized access occurred between [Date] and [Date].

What Information Was Involved?
The information may have included your:
☐ Name
☐ Social Security number
☐ Driver’s license or state identification number
☐ Financial account number and accompanying access information
☐ [Other]

What We Are Doing.
• Immediately secured the involved systems and engaged a leading cybersecurity firm.
• Notified law enforcement and relevant regulatory authorities.
• Offering you [12/24] months of complimentary credit monitoring and identity theft protection through [Provider Name].  To activate, visit [URL] and use code [CODE] by [Deadline].

What You Can Do.
We recommend that you:
1. Enroll in the complimentary credit-monitoring service.
2. Review your credit reports and account statements for unauthorized activity.
3. Consider placing a fraud alert or security freeze on your credit files.  Under Alaska law, you may obtain a security freeze free of charge.

Contact Information for the Three Nationwide Consumer Reporting Agencies
• Equifax – 1-800-685-1111 – www.equifax.com
• Experian – 1-888-397-3742 – www.experian.com
• TransUnion – 1-800-680-7289 – www.transunion.com

Federal Trade Commission
You may obtain additional information about identity theft from the FTC at www.identitytheft.gov or 1-877-ID-THEFT (438-4338).

For More Information.
If you have questions, please call our dedicated toll-free hotline at [###-###-####] Monday through Friday, [X a.m.–X p.m.] Alaska Time, or e-mail us at [E-mail].  You may also write to us at:

[Company Name]
[Address]
Attn: Privacy Office

We regret any concern this incident may cause and remain committed to safeguarding your information.

Sincerely,

____________________________________
[Authorized Signatory]
[Title]
[Company Name]

3. Optional Substitute Notice (Summary)

(Use only if written/e-mail notice is impracticable AND the incident meets the statutory cost or population thresholds.)

1. E-mail notice (if address available).
2. Conspicuous posting on Company’s website.
3. Statewide Alaska media publication.

4. Statutory Reference Sheet

• Alaska Stat. § 45.48.010 – .090 (Personal Information Protection Act)
• Alaska Stat. § 45.48.010(a) – Consumer notification requirement
• Alaska Stat. § 45.48.010(b) – Timing (“without unreasonable delay”)
• Alaska Stat. § 45.48.010(c) – Written Attorney General notice before relying on a no-harm determination
• Alaska Stat. § 45.48.040(a) – Notice to nationwide consumer credit reporting agencies when more than 1,000 residents are notified

END OF TEMPLATE