WEST VIRGINIA DATA BREACH NOTIFICATION LETTER
(Template for Notice to the West Virginia Attorney General and/or Affected Consumers)
[// GUIDANCE: This template is intended to satisfy the core content and timing requirements of the West Virginia Breach of Personal Information Notification Act, W. Va. Code §§ 46A-2A-101 et seq., and to incorporate generally accepted best practices. Customize bracketed items, delete unused options, and review for matter-specific accuracy before sending.]
TABLE OF CONTENTS
- Document Header
- Definitions
- Operative Provisions
3.1 Statutory Notice Statement
3.2 Description of the Incident
3.3 Personal Information Involved
3.4 Remedial Measures Undertaken by the Company
3.5 Protective Measures Available to [Consumers]/[AG]
3.6 Credit Monitoring Offer (optional)
3.7 Contact Information & Further Assistance - Statutory Compliance & Reservation of Rights
- Execution Block
- Attachments & Enclosures
1. DOCUMENT HEADER
Date: [DATE]
Via:
☐ Certified Mail – Return Receipt Requested
☐ Electronic Mail (encrypted PDF)
☐ Personal Delivery
(select all that apply)
To:
[RECIPIENT NAME]
[RECIPIENT TITLE]
[OFFICE / ADDRESS / EMAIL]
Re: Notification of Data Security Incident – West Virginia Breach of Personal Information Notification Act
2. DEFINITIONS
For purposes of this Letter, the following capitalized terms have the meanings set forth below:
- “Act” means the West Virginia Breach of Personal Information Notification Act, W. Va. Code §§ 46A-2A-101 et seq.
- “Breach” or “Incident” means the unauthorized access to and acquisition of computerized data that materially compromises the security, confidentiality, or integrity of Personal Information maintained by the Company, as those terms are defined in the Act.
- “Company” means [COMPANY LEGAL NAME], a [STATE OF INCORPORATION] [entity type] with its principal place of business at [ADDRESS].
- “Personal Information” has the meaning assigned in W. Va. Code § 46A-2A-101(4), consisting of an individual’s first name or first initial and last name in combination with[—select all that apply—]
a. Social Security number;
b. Driver’s license or state-issued identification card number;
c. Financial account, credit card, or debit card number in combination with any required security code, access code, or password; or
d. [OTHER STATUTORY ELEMENTS, if applicable]. - “You” or “Your” refers to the addressee of this Letter, either (i) each affected West Virginia Consumer, or (ii) the West Virginia Office of the Attorney General, as context dictates.
3. OPERATIVE PROVISIONS
3.1 Statutory Notice Statement
Pursuant to § 46A-2A-102 of the Act, the Company hereby provides written notice of a Breach that involves Personal Information relating to West Virginia residents.
3.2 Description of the Incident
On [DISCOVERY DATE], the Company became aware of suspicious activity indicating potential unauthorized access to its [SYSTEM/NETWORK]. A forensic investigation completed on [INVESTIGATION COMPLETION DATE] confirmed that, between [START DATE] and [END DATE], an unauthorized actor accessed certain Company files containing Personal Information.
[// GUIDANCE: Provide a concise, good-faith narrative. Avoid unnecessary technical jargon or speculative statements.]
3.3 Personal Information Involved
The investigation determined that the following categories of Personal Information pertaining to [NUMBER] West Virginia residents were, or are reasonably believed to have been, accessed:
• [CATEGORY 1]
• [CATEGORY 2]
• [ETC.]
3.4 Remedial Measures Undertaken by the Company
Immediately upon discovery, the Company:
1. Isolated the affected systems and engaged an independent cyber-security firm to conduct a comprehensive forensic review;
2. Implemented enhanced endpoint detection, multi-factor authentication, and mandatory password resets enterprise-wide;
3. Notified federal and state law-enforcement authorities; and
4. Established a dedicated incident-response team and call center to assist affected individuals.
3.5 Protective Measures Available to [Consumers]/[AG]
For Consumers:
1. Place a fraud alert or security freeze on Your credit files by contacting the nationwide consumer reporting agencies listed in Attachment A.
2. Review account statements and credit reports for suspicious activity.
3. Report suspected identity theft to the Federal Trade Commission (“FTC”) at www.identitytheft.gov or 1-877-438-4338.
For the Attorney General:
The Company will fully cooperate with any request for additional information under § 46A-2A-104 of the Act and will preserve all relevant evidence.
3.6 Credit Monitoring Offer (optional – consumer notice only)
To help protect Your identity, the Company is offering [12/24] months of complimentary credit monitoring and identity-theft restoration services through [SERVICE PROVIDER]. To enroll, please follow the instructions in Attachment B no later than [ENROLLMENT DEADLINE].
3.7 Contact Information & Further Assistance
If You have questions, please contact the Company’s dedicated incident helpline at [TOLL-FREE NUMBER] (Monday–Friday, 8 a.m.–8 p.m. Eastern) or email [INCIDENT EMAIL ADDRESS]. Written inquiries may be directed to:
Data Privacy Officer
[COMPANY LEGAL NAME]
[ADDRESS]
[EMAIL]
4. STATUTORY COMPLIANCE & RESERVATION OF RIGHTS
The Company provides this notice in compliance with, and to the extent required by, the Act. Nothing herein shall be construed as an admission of liability or of the existence or scope of any facts beyond those expressly stated. The Company expressly reserves all rights, defenses, and privileges available under applicable law.
[// GUIDANCE: If > 1,000 WV residents are affected, remember to transmit contemporaneous notice to the three nationwide consumer reporting agencies pursuant to § 46A-2A-102(b).]
5. EXECUTION BLOCK
Respectfully submitted,
[COMPANY LEGAL NAME]
By: _________
Name: [AUTHORIZED SIGNATORY]
Title: [OFFICER TITLE]
Date: [DATE]
6. ATTACHMENTS & ENCLOSURES
Attachment A – Contact Information for Consumer Reporting Agencies
Attachment B – Enrollment Instructions for Complimentary Credit Monitoring (if offered)
Attachment C – “How to Place a Security Freeze” Advisory
[// GUIDANCE: West Virginia law requires disclosure of consumer reporting agency contact data when the offer of a security freeze is made or recommended.]
Attachment A
Contact Information for Major Consumer Reporting Agencies
-
Equifax Information Services LLC
P.O. Box 105788, Atlanta, GA 30348-5788
1-800-525-6285 | www.equifax.com -
Experian Information Solutions, Inc.
P.O. Box 9554, Allen, TX 75013
1-888-397-3742 | www.experian.com -
TransUnion LLC
P.O. Box 2000, Chester, PA 19016-2000
1-800-680-7289 | www.transunion.com
(End of Template)