WASHINGTON DATA BREACH NOTIFICATION PACKAGE

(Attorney General & Consumer Notice Templates)

[// GUIDANCE: Replace every bracketed, ALL-CAPS placeholder before issuance. Do not add any personal information of affected individuals into either letter. Submit the Attorney General notice and the consumer notice via the WA AGO Data Breach Notification Portal unless otherwise instructed by outside counsel.]

TABLE OF CONTENTS

1. Attorney General Notification Letter Template
2. Consumer (Washington Resident) Notification Letter Template
3. Attachment A – Sample List of Toll-Free Contact Numbers
4. Attachment B – Optional Credit-Monitoring Offer Language

1. ATTORNEY GENERAL NOTIFICATION LETTER TEMPLATE

(Complies with Wash. Rev. Code § 19.255.010)

[COMPANY LETTERHEAD]
[DATE]

Via AGO Data Breach Notification Portal
Office of the Attorney General
State of Washington
Consumer Protection Division

Re: Immediate Notification of Data Security Breach – Wash. Rev. Code § 19.255.010

Dear Attorney General [AG NAME OR “Sir/Madam”]:

Pursuant to Wash. Rev. Code § 19.255.010 and related regulations, [COMPANY LEGAL NAME] (“Company”) hereby provides notice of a data security incident involving the personal information of Washington residents.

1. Identity of Reporting Entity
   Company Legal Name: [COMPANY LEGAL NAME]
   Business Address: [STREET, CITY, STATE, ZIP]
   FEIN / WA UBI No.: [NUMBER]
   Point of Contact: [NAME, TITLE, DIRECT DIAL, EMAIL]

2. Nature of the Breach
   a. Incident Description: [BRIEF, TECHNICALLY ACCURATE SUMMARY – 2–3 sentences].
   b. Incident Vector (if known): [EXAMPLE: “Credential-stuffing attack”].
   c. Type(s) of Personal Information Involved (check all that apply):
   • Social Security numbers
   • Driver’s license / ID numbers
   • Bank or credit-card numbers + security code
   • Health-insurance information
   • Biometric data
   • Other: [DESCRIBE]

3. Key Dates
   • Date(s) of Breach: [MM/DD/YYYY – MM/DD/YYYY]
   • Date Breach Discovered: [MM/DD/YYYY]
   • Date Contained / Secured: [MM/DD/YYYY]
   • Date Consumer Notice Will Be Provided: [NO LATER THAN 30 DAYS AFTER DISCOVERY]

4. Scope of Impact
   • Total Individuals Affected (Worldwide): [NUMBER]
   • Washington Residents Affected: [NUMBER]
   • Other Jurisdictions Notified / To Be Notified: [LIST]

5. Remediation Measures Implemented or Planned
   • [Example: “Forced password reset for all impacted credentials.”]
   • [Example: “Enabled multifactor authentication enterprise-wide.”]
   • [Example: “Engaged third-party cybersecurity firm to conduct forensic analysis.”]

6. Consumer Notification Strategy
   • Delivery Method(s): [EMAIL / USPS FIRST-CLASS / BOTH]
   • Plain-language template attached hereto as Exhibit 1.
   • Credit-monitoring offer of [12/24] months will be provided at no cost (see Attachment B).

7. Law-Enforcement & Regulatory Coordination
   • FBI IC3 report submitted on [MM/DD/YYYY] (Ref. No. [NUMBER]).
   • No request for delayed notification has been made by any law-enforcement agency.

8. Additional Information
   Company has established a dedicated call center staffed from [HOURS, TIME ZONE] at ###-###-#### to respond to inquiries from affected Washington residents.

Please contact the undersigned with any questions or requests for supplemental information.

Sincerely,

[NAME]
[TITLE]
[COMPANY LEGAL NAME]
[EMAIL] | [DIRECT DIAL]

Enclosures:
• Exhibit 1 – Consumer Notification Letter (Plain-Language)
• Attachment A – Toll-Free Contact Numbers
• Attachment B – Credit-Monitoring Offer Language (if applicable)

2. CONSUMER NOTIFICATION LETTER TEMPLATE

(Plain-language notice – Wash. Rev. Code § 19.255.010(8))

[COMPANY LOGO OR LETTERHEAD]
[DATE]

Subject: Important Notice of Data Security Incident

Dear [FIRST NAME LAST NAME]:

What Happened?
On [DISCOVERY DATE], we learned that an unauthorized party gained access to certain Company systems between [DATE RANGE]. We immediately secured the environment, engaged leading cybersecurity experts, and began an extensive investigation.

What Information Was Involved?
The investigation determined that the following types of your personal information were involved:
[ ] Social Security number
[ ] Driver’s license or state identification number
[ ] Bank / credit-card number + security code
[ ] Health-insurance information
[ ] Biometric data
[ ] Other: [DESCRIBE IN PLAIN LANGUAGE]

We have no evidence at this time that your information has been misused; however, we are notifying you out of an abundance of caution.

What We Are Doing
• We contained the incident and implemented enhanced security safeguards, including [LIST KEY MEASURES].
• We have arranged for you to receive [12/24] months of complimentary credit monitoring and identity theft protection through [VENDOR NAME]. Instructions to enroll appear below.
• We filed the required notice with the Washington State Attorney General and are cooperating with law enforcement.

What You Can Do
1. Enroll in the free credit-monitoring service by [DEADLINE] using the code below:
• Provider: [VENDOR NAME]
• Enrollment Code: [UNIQUE CODE]
• Website / Phone: [URL / PHONE]
2. Review your account statements and credit reports. You are entitled to one free credit report every 12 months from each major credit reporting agency.
3. Place a fraud alert or credit freeze if you believe you are at risk. (See Attachment A for contact information.)
4. Remain vigilant for unsolicited emails, calls, or texts asking for personal information.

For More Information
If you have questions, please call our dedicated assistance line at ###-###-#### (M–F, [X a.m.–X p.m. PT]) or email us at [EMAIL]. You may also write to us at [COMPANY ADDRESS].

Protecting your information is our top priority. We regret any inconvenience this incident may cause and appreciate your trust.

Sincerely,

[NAME]
[TITLE]
[COMPANY LEGAL NAME]

Enclosures:
Attachment A – How to Contact the Credit Reporting Agencies & the FTC
Attachment B – Instructions for Free Credit Monitoring (if offered)

3. ATTACHMENT A

TOLL-FREE CONTACT NUMBERS (To Be Included With Consumer Notice)

Credit Reporting Agencies
• Equifax – 800-349-9960 | equifax.com
• Experian – 888-397-3742 | experian.com
• TransUnion – 800-680-7289 | transunion.com

Federal Trade Commission (Identity Theft)
• 877-ID-THEFT (877-438-4338) | identitytheft.gov

Washington Attorney General – Consumer Protection Division
• 800-551-4636 | atg.wa.gov

[// GUIDANCE: Verify numbers prior to final issuance.]

4. ATTACHMENT B

OPTIONAL CREDIT-MONITORING OFFER LANGUAGE

[// GUIDANCE: Only include if the Company will provide credit monitoring/identity-theft services.]

We have retained [VENDOR NAME], a global leader in identity-protection services, to offer you [12/24] months of complimentary credit monitoring, identity-theft resolution, and $1 million in identity-theft insurance (policy limits apply). To activate:

1. Visit [URL] or call [PHONE].
2. Provide Enrollment Code: [UNIQUE CODE].
3. Enroll by [ENROLLMENT DEADLINE].

Enrollment will not harm your credit score. You are under no obligation to accept this offer.

[// GUIDANCE: This package satisfies WA content requirements (Wash. Rev. Code § 19.255.010) by:
• Plain-language consumer letter;
• Identification of breach date, discovery date, and information types;
• Inclusion of toll-free numbers for credit bureaus and FTC;
• Advice to remain vigilant;
• Exclusion of the data elements actually compromised;
• Separate AG notice containing numerical impact, timeline, remediation, and sample consumer letter.

Deliver the consumer notice no later than 30 days after breach discovery unless law enforcement requests delay. Retain proof of mailing or electronic transmission for at least five years.]