Data breach notices deserve a slow read

A data breach notice may be real, junk mail, or a scam that looks helpful. Do not use the link or phone number in it yet. First, check the notice through a company site or number you already know. Save the notice and its envelope.

The Attorney General posts sample notices for breaches that affect more than 500 California residents. A match can help confirm a letter. An absent match does not mean that it is fake. Smaller breaches are not posted there, and a filing may arrive later.

Read which data was exposed. Change an exposed password anywhere you used it again. For card data, call the card issuer. Think about a free credit freeze if the data could help someone open a new account. For medical or insurance data, check with the right provider or insurer too.

Civil Code section 1798.82 covers some breaches. A covered business generally must notify affected California residents within 30 calendar days after it finds the breach. An allowed law-enforcement delay is an exception. So is time that is reasonably needed to find the scope or restore system integrity.

If the business notifies more than 500 California residents, another clock applies. It generally has 15 calendar days after the consumer notices to send a sample to the Attorney General. These are duties for the business. They are not deadlines for a consumer to click a link or sign up.