Same Breach, Two States, Two Different Letters. What Your Address Actually Decides

The letter arrives in a window envelope, three or four paragraphs of careful prose, and the first instinct is to read it as a measurement of how much trouble you are in. It is not that. It is a compliance document, drafted to satisfy a statute, and the statute in question is almost never the one where the company keeps its headquarters. It is the one where you keep your mailbox. That single fact explains most of what people find confusing about these notices: why two households hit by the same incident receive letters that say different things, on different dates, offering different remedies.

The assumption is that the letter sizes your risk. It sizes a legal threshold

Most people read a breach notice as a verdict: serious enough to write means serious. The reverse inference does the real damage, because silence is read as safety. Notification duties turn on categories of data, not on how badly a given record could be used against you. A file with your name and Social Security number typically triggers a mandatory letter. A file with your full purchase history, your device identifiers, your employer, and your home address may trigger nothing at all in some states, even though a competent fraudster would rather have the second file. The letter marks a line in a statute. It does not measure exposure.

That gap runs the other direction too. Companies send courtesy notices for incidents that never crossed a legal threshold, partly because doing so is cheaper than arguing about it later. So the arrival of a letter tells you a category of data was probably involved, and the absence of one tells you considerably less than you would like. What you do next should depend on which data elements the letter names, and on whether it names any at all, rather than on the tone of the paragraph explaining how seriously the company takes your privacy.

Residency, not the company's home state, picks the rulebook

Every state has a breach notification law, and each one applies to residents of that state regardless of where the breached company sits. A retailer in Ohio with customers in thirty states works from thirty rulebooks at once, which is why the letters diverge. Some statutes set a hard clock, thirty days or forty-five days from discovery or from determining that notice is required. Others say only that notice must go out without unreasonable delay, which in practice stretches while forensics run. A few require the company to notify the state attorney general in parallel, sometimes only once a resident count crosses a threshold.

The content requirements differ as well. Certain states require the letter to describe the incident, to list the specific categories of information involved, to give a toll-free number, and to include contact details for the three nationwide credit reporting agencies. Others leave the drafting largely to the company. A small group requires that free credit monitoring be offered when Social Security numbers or driver's license numbers are exposed, and the required duration is not uniform across those states. If you moved recently, the rulebook that applies is the address the company had on file, which may be the old one. Updating your address with the institutions holding sensitive data is the cheapest fix on this list.

The federal layer sits underneath, and one part of it is free everywhere

Federal law does not preempt the state notification statutes for most consumer data, but it does standardize a few things that matter to you. Since 2018, placing and lifting a security freeze at each of the three nationwide credit reporting agencies has been free in every state, for every resident, with no incident required as a precondition. The Federal Trade Commission oversees consumer protection in this area and maintains the government's identity theft reporting process. Sector rules layer on top: health information handled by covered entities runs through a separate federal breach standard, and financial institutions answer to their own regulators.

What this means in practice is that the most useful remedy available to you is not the one printed in the letter. The enrollment code for a year of monitoring is a detection service. It tells you after something has happened. A freeze is a prevention service, it blocks new credit accounts opened in your name, and it costs nothing. The letter rarely leads with that, because the letter is written to satisfy a statute that requires an offer, not to rank your options by value.

The order to work it, and the two steps that are hard to undo

Read the letter for the data elements named, then act by category. Social Security number means freeze all three bureaus first. Payment card number means call the issuer for a replacement card, which is routine and reversible. Login credentials mean change that password and any place you reused it, starting with your primary email account, because email is the reset path for everything else. Only then deal with the enrollment code, which usually carries a deadline of sixty to ninety days and expires quietly.

Two moves deserve caution. Closing a long-held credit account shortens your average account age and cannot be undone by reopening it, so freeze and monitor before you close anything. And accepting a settlement payment, when a breach eventually produces one, generally releases your claims, which forecloses opting out later for a larger individual claim. Keep the letter itself. Some states set the statute of limitations from the date of discovery, and a dated notice is the cleanest proof of when you learned.

The honest arithmetic on the free year of monitoring is that its value depends almost entirely on whether you already froze your credit. If you did, the monitoring is a mild convenience. If you did not, it is a smoke alarm in a house with the door unlocked. The freeze is the step that pays.