Montana Data Breach Notification Package

(Template – Court-Ready Draft)

[// GUIDANCE: This package contains two coordinated templates: (A) a Consumer Notification Letter and (B) the contemporaneous Attorney General Notice required by Montana law. Use both together to ensure statutory compliance. Tailor all bracketed terms before use.]

TABLE OF CONTENTS

1. Package Overview & Statutory Snapshot
2. Defined Terms
3. Template A — Consumer Notification Letter
4. Template B — Attorney General Notification Letter
5. Attachment 1 — Credit-Monitoring Enrollment Instructions (optional)
6. Attachment 2 — Sample Address List Format (consumer mailing)

1. PACKAGE OVERVIEW & STATUTORY SNAPSHOT

• Governing Statute: Mont. Code Ann. § 30-14-1704 (2023).
• Timing: Written notice must be provided to (i) affected Montana residents and (ii) the Montana Department of Justice, Office of Consumer Protection (the “AG Notice”) no later than 30 days after confirmation of a breach of security involving Personal Information.
• Content Requirements (Consumer Notice):
– Breach date/estimated period;
– General description of the incident and Personal Information involved (do not include the actual data);
– Remedial measures already taken;
– Steps the individual can take to protect him-/herself;
– Toll-free contact information for: (a) the Company, (b) the three nationwide consumer reporting agencies, if ≥ 1,000 Montanans are affected.
• Content Requirements (AG Notice):
– All items above plus total number of Montana residents impacted and a sample of the Consumer Notice.

Failure to comply may trigger statutory penalties and civil enforcement by the Attorney General.

2. DEFINED TERMS

The following capitalized terms have the meanings indicated below and apply throughout both templates:

“Breach” means the unauthorized acquisition of computerized data that materially compromises the security, confidentiality, or integrity of Personal Information maintained by the Company.

“Company” means [COMPANY LEGAL NAME], a [STATE OF INCORPORATION] [corporation/LLC] with its principal place of business at [ADDRESS].

“Incident Date” means [DATE RANGE WHEN BREACH OCCURRED OR WAS DISCOVERED].

“Personal Information” has the meaning set forth in Mont. Code Ann. § 30-14-1704(2)(b) and generally includes an individual’s first name or first initial and last name in combination with any one or more of the following data elements when the name and data elements are not encrypted, redacted, or otherwise altered: Social Security number, driver’s license number or state-issued ID number, account number/credit or debit card number with any required security code, password, or access code, etc.

“Relevant Period” means the period beginning on the Incident Date and ending on the date written notice is provided.

3. TEMPLATE A — CONSUMER NOTIFICATION LETTER

(Montana Residents)

[COMPANY LETTERHEAD]
[STREET ADDRESS • CITY, STATE ZIP]
[PHONE] | [EMAIL] | [WEBSITE]

[DATE]

[CONSUMER NAME]
[STREET ADDRESS]
[CITY, STATE ZIP]

Re: Notice of Data Breach Affecting Your Personal Information

Dear [Mr./Ms.] [LAST NAME]:

1. What Happened
   On [INCIDENT DATE OR DATE RANGE], [COMPANY] determined that unauthorized activity involving certain company systems occurred. After a thorough investigation assisted by third-party cybersecurity specialists, we confirmed on [CONFIRMATION DATE] that an unauthorized actor may have accessed or acquired specific files containing Personal Information relating to you.

2. What Information Was Involved
   The data potentially involved your:
   • [e.g., full name]
   • [e.g., Social Security number (last four digits only displayed)]
   • [e.g., driver’s license number]
   • [e.g., financial account number and routing number]
   No payment-card PINs, security codes, or passwords were compromised.

3. What We Are Doing
   • Contained the Breach by [DESCRIBE MEASURES—e.g., isolating affected servers, rotating credentials].
   • Engaged leading cybersecurity and forensics firms to eradicate malware and reinforce our network.
   • Notified law-enforcement authorities and the Montana Attorney General as required by law.
   • Offered you [12/24] months of complimentary credit monitoring and identity-theft protection through [SERVICE PROVIDER]. See Attachment 1 for enrollment details.

4. What You Can Do
   • Remain vigilant and review account statements and credit reports.
   • Consider placing a fraud alert or security freeze on your credit files.
   • Monitor Explanation of Benefits (EOB) statements if you have received health-related services from us.
   • Refer to the “Additional Resources” section on the next page for agency contact information and further steps.

5. Additional Resources
   If you suspect identity theft, contact the Federal Trade Commission (FTC) or your local law-enforcement agency. You may obtain your credit report, free of charge, from each of the nationwide credit reporting agencies by visiting www.annualcreditreport.com or calling 1-877-322-8228.

[// GUIDANCE: If ≥ 1,000 MT residents are affected, insert the mandatory addresses and toll-free numbers for Equifax, Experian, and TransUnion here.]

6. Contact Us
   We regret any inconvenience or concern this may cause you. If you have questions, please contact our dedicated response line at [TOLL-FREE NUMBER], Monday through Friday, [HOURS], or email us at [BREACH-RESPONSE EMAIL].

Sincerely,

[AUTHORIZED SIGNATORY NAME]
[Title]
[COMPANY]

4. TEMPLATE B — ATTORNEY GENERAL NOTIFICATION LETTER

(Mont. Code Ann. § 30-14-1704 Compliance)

[COMPANY LETTERHEAD]
[STREET ADDRESS • CITY, STATE ZIP]
[PHONE] | [EMAIL]

[DATE]

Via Email & Certified Mail, Return Receipt Requested
Office of Consumer Protection
Montana Department of Justice
555 Fuller Avenue | P.O. Box 200151
Helena, MT 59620-0151
Email: [email protected]

Re: Notice of Data Breach by [COMPANY]

Dear Consumer Protection Staff:

Pursuant to Mont. Code Ann. § 30-14-1704, [COMPANY] hereby provides notice of a data Breach affecting Montana residents.

1. Incident Overview
   a. Incident Date(s): [INCIDENT DATE OR DATE RANGE].
   b. Discovery & Confirmation Date: [DISCOVERY DATE] / [CONFIRMATION DATE].
   c. Nature of the Breach: Unauthorized access to [DESCRIPTION OF SYSTEMS—e.g., cloud-based storage environment] resulting in potential acquisition of unencrypted Personal Information.
   d. Cause (if known): [BRIEF DESCRIPTION—e.g., spear-phishing email led to credential compromise].
   e. Remediation Undertaken: [BRIEF DESCRIPTION].

2. Type of Personal Information Involved
   • [ITEMIZED LIST—e.g., Social Security numbers, driver’s license numbers, financial account numbers with access codes].
   The data were not encrypted or redacted at the time of the incident.

3. Population Affected
   • Total number of individuals affected nationwide: [TOTAL].
   • Number of Montana residents affected: [# MT RESIDENTS].

4. Timing of Consumer Notice
   Written notice to affected Montana residents will be disseminated on [MAILING DATE], contemporaneous with this correspondence and within 30 days of confirmation of the Breach.

5. Services Offered
   [DESCRIBE—e.g., 24 months of credit monitoring and identity theft insurance up to $1 million through [PROVIDER]]. Enrollment instructions are included in the Consumer Notice.

6. Law-Enforcement Engagement
   The incident has been reported to [LAW-ENFORCEMENT AGENCY], case number [##]. No request for delayed notice was made or received.

7. Point of Contact
   Please direct any inquiries to:
   • [PRIMARY CONTACT NAME], [TITLE]
   • Phone: [DIRECT LINE] | Email: [EMAIL]

Enclosures:
1. Sample Consumer Notification Letter
2. Credit Monitoring Enrollment Instructions (Attachment 1)

Respectfully,

[AUTHORIZED SIGNATORY NAME]
[Title]
[COMPANY]

5. ATTACHMENT 1 — CREDIT-MONITORING ENROLLMENT INSTRUCTIONS

[// GUIDANCE: Insert vendor-supplied language here. Include activation code placeholder, deadline to enroll, coverage summary, and instructions for placing fraud alerts or credit freezes.]

6. ATTACHMENT 2 — SAMPLE ADDRESS LIST FORMAT

[// GUIDANCE: Provide CSV column headers: LastName, FirstName, StreetAddress, City, State, ZIP, Email (optional).]

FINAL COMPLIANCE CHECKLIST

1. Mail/Email Consumer Notice and AG Notice within 30 days of confirmation.
2. Include sample Consumer Notice with AG filing.
3. Omit any Personal Information from all notices.
4. If ≥ 1,000 Montana residents affected, add credit-bureau contact details.
5. Retain proof of mailing (certified mail receipts, email logs).
6. Preserve incident records for at least five (5) years to evidence compliance.

© [YEAR] [COMPANY]. All rights reserved. This template is provided for general informational purposes and does not constitute legal advice. Consult Montana-licensed counsel before final use.