| Row # | Jurisdiction | Abbreviation | Applicable Statute Citation | Number of Affected Residents | Percentage of Total Affected | Data Elements Triggering Notification | PII Affected | Financial Data Affected | PHI Affected | Notification Timing Requirement | Days from discovery/Determination | Content Requirements — Mandatory Elements | AG / Regulator Notification Required? | AG / Regulator Notification Timing | AG / Regulator Notification Threshold | Substitute Notice Permitted? | Substitute Notice Threshold / Conditions | Additional State-Specific Requirements | Planned Regulatory Filing Date | Planned Consumer Notification Mailing Start | Compliance Status | Notes |
| 1 | Connecticut | CT | Conn. Gen. Stat. § 36a-701b; Conn. Gen. Stat. § 38a-999b (Insurance Data Security Law) | 52114 | 16.37% | Name + SSN; Name + DL#; Name + Financial Acct #; PHI | 52114 | 13842 | 6735 | Within 60 days of discovery of breach | 60 | Description of incident; type of info compromised; steps taken; contact info for consumer inquiries; contact info for credit reporting agencies; advice on placing fraud alerts/security freezes | Yes — AG and CT Insurance Department | Concurrent with or prior to consumer notification; CT Ins. Dept. within 72 hours of determination | All breaches | Yes | Cost exceeds $250K, affected class >500K, or entity lacks sufficient contact info | CT Insurance Data Security Law (§ 38a-999b) requires separate notification to CT Insurance Department; insurer-specific obligations. Quorum is a regulated insurer. | August 14, 2023 | August 18, 2023 | Planned — On Track | Lead state for multistate AG coalition. Filed concurrently with CT Insurance Dept. Attn: AAG Diane Marchetti (Consumer Protection Division); Richard Nakamura (CT Insurance Dept., Financial Analysis Div., Cybersecurity Unit). |
| 2 | New York | NY | N.Y. Gen. Bus. Law § 899-aa (SHIELD Act) | 47831 | 15.03% | Name + SSN; Name + DL#; Name + Financial Acct # + access code; Biometric; Email + password; PHI (under separate statutes) | 47831 | 12713 | 6177 | In the most expedient time possible and without unreasonable delay | 0 | Description of incident; type of info compromised; telephone numbers and addresses of relevant state and federal agencies; contact info for consumer inquiries; description of steps taken to address breach | Yes — AG, DFS, and Division of State Police | Concurrent with consumer notification | All breaches | Yes | Cost exceeds $250K, affected class >500K, or entity lacks sufficient contact info | NY SHIELD Act imposes reasonable safeguards requirements. AG notification must include (i) content of notification, (ii) timing, (iii) approximate number of affected persons. DFS notification may also be required for financial data. | August 16, 2023 | August 18, 2023 | Planned — On Track | Second-largest affected state. Attn: AAG Mark Petrosian, Bureau of Internet and Technology. Co-lead for multistate AG coalition. |
| 3 | California | CA | Cal. Civ. Code § 1798.82; Cal. Civ. Code § 1798.29 (agencies); CMIA (Cal. Civ. Code § 56 et seq. for medical info) | 38206 | 12.00% | Name + SSN; Name + DL# / CA ID#; Name + Financial Acct # + access code; Medical info; Health insurance info | 38206 | 10157 | 4938 | In the most expedient time possible and without unreasonable delay | 0 | Prescribed format per Cal. Civ. Code § 1798.82(d): title 'Notice of Data Breach'; name & contact info of entity; types of PII compromised; date/estimated date/date range of breach; description of incident; toll-free numbers and addresses of credit reporting agencies; advice on fraud alerts/security freezes; if SSN: offer credit monitoring | Yes — AG | If >500 CA residents affected, submit sample copy to AG | >500 CA residents | Yes | Cost exceeds $250K, affected class >500K, or entity lacks sufficient contact info | California requires specific prescribed notification letter format per statute. CMIA may impose additional requirements for medical information. Must offer identity theft prevention and mitigation services if SSN compromised. | August 16, 2023 | August 18, 2023 | Planned — On Track | AG notification required because >500 CA residents (38,206). CMIA analysis applicable to PHI subset. |
| 4 | Texas | TX | Tex. Bus. & Com. Code § 521.053 | 29477 | 9.26% | Name + SSN; Name + DL# / govt. ID#; Name + Financial Acct # + access code | 29477 | 7835 | 3808 | As quickly as possible without unreasonable delay; not later than 60 days after discovery | 60 | Description of incident; type of info compromised; actions taken; contact info for entity; advice on credit reports and security freezes | Yes — AG | If >250 TX residents affected, notify AG | >250 TX residents | Yes | Cost exceeds $250K, affected class >500K, or entity lacks sufficient contact info | Texas requires notification to AG not later than 60 days after discovery if >250 residents affected. | August 17, 2023 | August 18, 2023 | Planned — On Track | Palomar HQ state. >250 threshold easily met. |
| 5 | Florida | FL | Fla. Stat. § 501.171 | 22913 | 7.20% | Name + SSN; Name + DL# / govt. ID#; Name + Financial Acct # + access code; Medical history; Health insurance info | 22913 | 6092 | 2961 | No later than 30 days after determination of breach or reason to believe breach occurred | 30 | Description of incident; date/estimated date of breach; type of info compromised; actions taken; contact info for entity; contact info for credit reporting agencies; advice on fraud alerts/security freezes | Yes — FDLE (Department of Law Enforcement) | Within 30 days of determination if >500 FL residents; within 30 days if 500 or fewer | >500 FL residents → notify FDLE; any breach → notify FDLE | Yes | Cost exceeds $250K, affected class >500K, or entity lacks sufficient contact info | Florida has a strict 30-day notification timeline. Must also notify FDLE. If >1,000 FL residents, must notify consumer reporting agencies. | August 17, 2023 | August 18, 2023 | Planned — On Track | 30-day timeline is among the strictest; compliance confirmed within timeline from August 4 determination date. |
| 6 | Pennsylvania | PA | 73 Pa. Stat. § 2303 (Breach of Personal Information Notification Act) | 18640 | 5.86% | Name + SSN; Name + DL# / state ID#; Name + Financial Acct # + access code | 18640 | 4954 | 2408 | Without unreasonable delay | 0 | Nature of breach; type of info compromised; remedial actions taken; contact info for entity; advice on credit reports and security freezes | Yes — AG | Concurrent with consumer notification | All breaches | Yes | Cost exceeds $100K, affected class >175K, or entity lacks sufficient contact info | PA substitute notice threshold is lower than many states ($100K cost or >175K affected). | August 17, 2023 | August 18, 2023 | Planned — On Track |
| 7 | Illinois | IL | 815 ILCS 530/10 (Personal Information Protection Act) | 16502 | 5.18% | Name + SSN; Name + DL# / state ID#; Name + Financial Acct # + access code; Medical info; Health insurance info; Biometric | 16502 | 4387 | 2132 | In the most expedient time possible and without unreasonable delay | 0 | Description of breach; type of info compromised; toll-free contact numbers for entity and credit reporting agencies; advice on placing fraud alerts/security freezes | Yes — AG | Concurrent with consumer notification | All breaches | Yes | Cost exceeds $250K, affected class >500K, or entity lacks sufficient contact info | Illinois BIPA may be relevant if biometric data involved (not applicable here). Standard notification requirements apply. | August 17, 2023 | August 18, 2023 | Planned — On Track |
| 8 | New Jersey | NJ | N.J. Stat. § 56:8-163 | 14388 | 4.52% | Name + SSN; Name + DL# / state ID#; Name + Financial Acct # + access code | 14388 | 3825 | 1859 | In the most expedient time possible and without unreasonable delay | 0 | Description of breach; type of info compromised; contact info for entity; advice on credit reports, fraud alerts, security freezes; toll-free numbers for credit reporting agencies; NJ Division of Consumer Affairs contact info | Yes — Division of State Police | Prior to consumer notification | All breaches | Yes | Cost exceeds $250K, affected class >500K, or entity lacks sufficient contact info | NJ requires notification to Division of State Police before consumer notification. | August 17, 2023 | August 18, 2023 | Planned — On Track |
| 9 | Ohio | OH | Ohio Rev. Code § 1349.19 | 11743 | 3.69% | Name + SSN; Name + DL# / state ID#; Name + Financial Acct # + access code | 11743 | 3122 | 1517 | In the most expedient time possible, but not later than 45 days following discovery or notification of the breach | 45 | Description of breach; type of info compromised; contact info for entity; telephone numbers and addresses of credit reporting agencies; advice on fraud alerts/security freezes | Yes — AG (if individual notifications sent) | Concurrent with or prior to consumer notification | All breaches where individual notification sent | Yes | Cost exceeds $250K, affected class >500K, or entity lacks sufficient contact info | Ohio 45-day outer limit is significant. Clearfield Notification Services LLC (notification vendor) headquartered in OH. | August 17, 2023 | August 18, 2023 | Planned — On Track |
| 10 | Massachusetts | MA | Mass. Gen. Laws ch. 93H, § 3; 201 CMR 17.00 | 10217 | 3.21% | Name + SSN; Name + DL# / state ID#; Name + Financial Acct # + access code | 10217 | 2717 | 1320 | As soon as practicable and without unreasonable delay | 0 | Prescribed format: right to obtain police report; right to request security freeze; description of incident; type of info compromised; actions taken; contact info for AG and DOCR | Yes — AG and Director of Consumer Affairs and Business Regulation (DOCR) | Concurrent with consumer notification; AG and DOCR must receive notification on same day as consumers | All breaches | Yes | Cost exceeds $250K, affected class >500K, or entity lacks sufficient contact info | MA has specific prescribed content requirements under 201 CMR 17.00; notification letter must include specific statutory language. Must use prescribed AG form. | August 17, 2023 | August 18, 2023 | Planned — On Track | MA-specific notification letter adapted for 201 CMR 17.00 requirements. |
| 11 | Georgia | GA | Ga. Code Ann. § 10-1-912 | 4812 | 1.51% | Name + SSN; Name + DL# / state ID#; Name + Financial Acct # + password/access code | 4812 | 1279 | 622 | In the most expedient time possible and without unreasonable delay | 0 | Description of breach; type of info compromised; contact info for entity; advice on credit reports and fraud alerts | No (recommended but not required by statute) | N/A | N/A | Yes | Cost exceeds $250K, affected class >500K, or entity lacks sufficient contact info | Georgia does not statutorily require AG notification, but recommended as best practice. | N/A (consumer notification only) | August 18, 2023 | Planned — On Track |
| 12 | Virginia | VA | Va. Code Ann. § 18.2-186.6 | 4500 | 1.41% | Name + SSN; Name + DL# / state ID#; Name + Financial Acct # + access code; Medical info; Health insurance info | 4500 | 1196 | 581 | Without unreasonable delay | 0 | Description of incident; type of info compromised; contact info for entity; toll-free numbers for credit reporting agencies; FTC contact info; advice on fraud alerts/security freezes | Yes — AG | Concurrent with consumer notification | All breaches | Yes | Cost exceeds $50K, affected class >100K, or entity lacks sufficient contact info | VA substitute notice threshold is lower than most states ($50K cost or >100K affected). Graystone Forensics LLC headquartered in VA. | August 17, 2023 | August 18, 2023 | Planned — On Track |
| 13 | Maryland | MD | Md. Code, Com. Law § 14-3504 | 4200 | 1.32% | Name + SSN; Name + DL# / state ID#; Name + Financial Acct # + access code; Health info; Health insurance info | 4200 | 1116 | 542 | As soon as reasonably practicable, but not later than 45 days after discovery | 45 | Description of breach; type of info compromised; contact info for entity; toll-free numbers for credit reporting agencies and FTC; advice on fraud alerts/security freezes; if SSN: offer credit monitoring | Yes — AG | Concurrent with or prior to consumer notification | All breaches | Yes | Cost exceeds $100K, affected class >175K, or entity lacks sufficient contact info | MD 45-day outer limit. If SSN compromised, must offer credit monitoring (being offered — 24 months). | August 17, 2023 | August 18, 2023 | Planned — On Track |
| 14 | North Carolina | NC | N.C. Gen. Stat. § 75-65 | 3900 | 1.23% | Name + SSN; Name + DL# / state ID#; Name + Financial Acct # + access code | 3900 | 1037 | 504 | Without unreasonable delay | 0 | Description of breach; type of info compromised; steps taken; contact info for entity; toll-free numbers for credit reporting agencies and FTC; advice on fraud alerts/security freezes | Yes — AG (Consumer Protection Division) | Concurrent with consumer notification | All breaches | Yes | Cost exceeds $250K, affected class >500K, or entity lacks sufficient contact info | August 17, 2023 | August 18, 2023 | Planned — On Track |
| 15 | South Carolina | SC | S.C. Code Ann. § 39-1-90 | 3600 | 1.13% | Name + SSN; Name + DL# / state ID#; Name + Financial Acct # + access code | 3600 | 957 | 465 | Without unreasonable delay | 0 | Description of breach; type of info compromised; contact info for entity; advice on credit reports and fraud alerts | Yes — Consumer Protection Division of AG | Concurrent with consumer notification | All breaches | Yes | Cost exceeds $250K, affected class >500K, or entity lacks sufficient contact info | August 17, 2023 | August 18, 2023 | Planned — On Track |
| 16 | Michigan | MI | Mich. Comp. Laws § 445.72 | 3400 | 1.07% | Name + SSN; Name + DL# / state ID#; Name + Financial Acct # + access code | 3400 | 904 | 439 | Without unreasonable delay | 0 | Description of breach; type of info compromised; contact info for entity; toll-free numbers for credit reporting agencies and FTC; advice on fraud alerts/security freezes | No (not required by statute) | N/A | N/A | Yes | Cost exceeds $250K, affected class >500K, or entity lacks sufficient contact info | Michigan does not require AG notification. | N/A (consumer notification only) | August 18, 2023 | Planned — On Track |
| 17 | Minnesota | MN | Minn. Stat. § 325E.61 | 3200 | 1.01% | Name + SSN; Name + DL# / state ID#; Name + Financial Acct # + access code | 3200 | 851 | 413 | In the most expedient time possible and without unreasonable delay | 0 | Description of breach; type of info compromised; date/approximate date of breach; contact info for entity; advice on fraud alerts/security freezes | No (AG notification required only for certain regulated entities) | N/A | N/A | Yes | Cost exceeds $250K, affected class >500K, or entity lacks sufficient contact info | MN does not require AG notification for all entities. Insurer may have separate obligations. | August 18, 2023 (consumer) | August 18, 2023 | Planned — On Track |
| 18 | Indiana | IN | Ind. Code § 24-4.9-3-3 | 3000 | 0.94% | Name + SSN; Name + DL# / state ID#; Name + Financial Acct # + access code | 3000 | 798 | 388 | Without unreasonable delay | 0 | Description of breach; type of info compromised; contact info for entity; toll-free numbers for credit reporting agencies; advice on fraud alerts/security freezes; toll-free numbers for FTC and AG | Yes — AG | Concurrent with consumer notification | All breaches | Yes | Cost exceeds $250K, affected class >500K, or entity lacks sufficient contact info | August 18, 2023 | August 18, 2023 | Planned — On Track |
| 19 | Wisconsin | WI | Wis. Stat. § 134.98 | 2800 | 0.88% | Name + SSN; Name + DL# / state ID#; Name + Financial Acct # + access code | 2800 | 744 | 362 | Within a reasonable time, not to exceed 45 days | 45 | Type of info compromised; description of actions taken; toll-free contact for entity | No (not required by statute) | N/A | N/A | Yes | Per statutory provisions | WI 45-day outer limit. | N/A (consumer notification only) | August 18, 2023 | Planned — On Track |
| 20 | Colorado | CO | Colo. Rev. Stat. § 6-1-716 | 2700 | 0.85% | Name + SSN; Name + DL# / state ID#; Name + Financial Acct # + access code; Medical info; Health insurance info; Biometric | 2700 | 718 | 349 | In the most expedient time possible and without unreasonable delay, but not later than 30 days after determination | 30 | Date/estimated date of breach; description of incident; type of info compromised; contact info for entity; toll-free numbers for credit reporting agencies and FTC; advice on fraud alerts/security freezes | Yes — AG | Concurrent with consumer notification | If >500 CO residents, notification to AG required | Yes | Cost exceeds $250K, affected class >500K, or entity lacks sufficient contact info | Colorado 30-day outer limit — among the strictest. Must include statement that Coloradans can obtain info from AG's office. | August 17, 2023 | August 18, 2023 | Planned — On Track | 30-day timeline critical — from August 4 determination, deadline is September 3; filing planned August 17. |
| 21 | Arizona | AZ | Ariz. Rev. Stat. § 18-552 | 2500 | 0.79% | Name + SSN; Name + DL# / state ID#; Name + Financial Acct # + access code; Health insurance info; Medical info | 2500 | 665 | 323 | Within 45 days of determination | 45 | Description of incident; date of breach; type of info compromised; contact info for entity; contact info for credit reporting agencies and FTC; advice on fraud alerts/security freezes | Yes — AG and Director of AZ Dept. of Homeland Security | Concurrent with consumer notification | If >1,000 AZ residents | Yes | Cost exceeds $100K, affected class >200K, or entity lacks sufficient contact info | AZ 45-day limit. AG and DHS notification required if >1,000 AZ residents. | August 18, 2023 | August 18, 2023 | Planned — On Track |
| 22 | Oregon | OR | Or. Rev. Stat. § 646A.604 | 2300 | 0.72% | Name + SSN; Name + DL# / state ID#; Name + Financial Acct # + access code; Medical info; Health insurance info; Biometric | 2300 | 612 | 297 | In the most expedient time possible and without unreasonable delay, but not later than 45 days | 45 | Description of incident; type of info compromised; contact info for entity; contact info for credit reporting agencies and FTC; advice on fraud alerts/security freezes; if SSN: offer credit monitoring | Yes — AG | If >250 OR residents, notification to AG required within 45 days | >250 OR residents | Yes | Cost exceeds $250K, affected class >350K, or entity lacks sufficient contact info | Oregon requires offer of identity theft monitoring if SSN compromised. Threshold for AG notification is >250 residents. | August 18, 2023 | August 18, 2023 | Planned — On Track |
| 23 | Washington | WA | Wash. Rev. Code § 19.255.010 | 2200 | 0.69% | Name + SSN; Name + DL# / state ID#; Name + Financial Acct # + access code; Medical info; Health insurance info; Full DOB | 2200 | 585 | 284 | In the most expedient time possible and without unreasonable delay, but not more than 30 days after discovery | 30 | Description of incident; type of info compromised; date of breach; contact info for entity; toll-free numbers for credit reporting agencies; advice on fraud alerts/security freezes | Yes — AG | Within 30 days of discovery; AG must be notified if >500 WA residents | >500 WA residents | Yes | Cost exceeds $250K, affected class >500K, or entity lacks sufficient contact info | Washington 30-day limit is strict. Must notify AG electronically. | August 17, 2023 | August 18, 2023 | Planned — On Track | 30-day timeline critical — compliance confirmed. |
| 24 | Tennessee | TN | Tenn. Code Ann. § 47-18-2107 | 2100 | 0.66% | Name + SSN; Name + DL# / state ID#; Name + Financial Acct # + access code | 2100 | 558 | 271 | In the most expedient time possible and without unreasonable delay, but not later than 45 days after discovery | 45 | Description of breach; type of info compromised; contact info for entity; advice on credit reports and fraud alerts | No (not required by statute) | N/A | N/A | Yes | Cost exceeds $250K, affected class >500K, or entity lacks sufficient contact info | N/A (consumer notification only) | August 18, 2023 | Planned — On Track |
| 25 | Missouri | MO | Mo. Rev. Stat. § 407.1500 | 2000 | 0.63% | Name + SSN; Name + DL# / state ID#; Name + Financial Acct # + access code; Medical info; Health insurance info | 2000 | 532 | 258 | Without unreasonable delay | 0 | Description of breach; type of info compromised; date of breach; contact info for entity; advice on credit reports and fraud alerts | Yes — AG | Concurrent with consumer notification | All breaches | Yes | Cost exceeds $250K, affected class >500K, or entity lacks sufficient contact info | August 18, 2023 | August 18, 2023 | Planned — On Track |
| 26 | Louisiana | LA | La. Rev. Stat. § 51:3074 (Database Security Breach Notification Law) | 1900 | 0.60% | Name + SSN; Name + DL# / state ID#; Name + Financial Acct # + access code | 1900 | 505 | 245 | In the most expedient time possible and without unreasonable delay, but not later than 60 days from discovery | 60 | Description of breach; type of info compromised; actions taken; contact info for entity; advice on fraud alerts/security freezes | Yes — AG (Consumer Protection Section) | Within 10 days of notification to consumers | All breaches | Yes | Cost exceeds $250K, affected class >500K, or entity lacks sufficient contact info | LA requires AG notification within 10 days of consumer notification. | August 25, 2023 | August 18, 2023 | Planned — On Track |
| 27 | Nevada | NV | Nev. Rev. Stat. § 603A.220 | 1800 | 0.57% | Name + SSN; Name + DL# / state ID#; Name + Financial Acct # + access code; Medical ID; Health insurance ID | 1800 | 479 | 233 | In the most expedient time possible and without unreasonable delay | 0 | Description of breach; type of info compromised; contact info for entity; toll-free numbers for credit reporting agencies; advice on fraud alerts/security freezes | No (notification to AG not required by statute) | N/A | N/A | Yes | Cost exceeds $250K, affected class >500K, or entity lacks sufficient contact info | Nevada does not require AG notification. Offer of credit monitoring/identity theft prevention required if SSN compromised. | N/A (consumer notification only) | August 18, 2023 | Planned — On Track |
| 28 | Iowa | IA | Iowa Code § 715C.2 | 1704 | 0.54% | Name + SSN; Name + DL# / state ID#; Name + Financial Acct # + access code | 1704 | 453 | 220 | In the most expedient time possible and without unreasonable delay, but not later than 60 days after discovery | 60 | Description of breach; type of info compromised; contact info for entity; toll-free numbers for credit reporting agencies; advice on fraud alerts/security freezes | Yes — AG (Consumer Protection Division) | Within 5 business days of notifying consumers | >500 IA residents | Yes | Cost exceeds $250K, affected class >500K, or entity lacks sufficient contact info | Iowa requires AG notification within 5 business days of consumer notification if >500 residents affected. | August 25, 2023 | August 18, 2023 | Planned — On Track |
| 29 | New Hampshire | NH | N.H. Rev. Stat. Ann. § 359-C:20 | 1500 | 0.47% | Name + SSN; Name + DL# / state ID#; Name + Financial Acct # + access code | 1500 | 399 | 194 | As soon as possible | 0 | Description of breach; type of info compromised; date of breach; contact info for entity; toll-free numbers for credit reporting agencies; advice on fraud alerts/security freezes | Yes — AG | Concurrent with consumer notification | All breaches | Yes | Cost exceeds $5K, affected class >1K, or entity lacks sufficient contact info | NH substitute notice threshold is very low ($5K cost or >1K affected). | August 17, 2023 | August 18, 2023 | Planned — On Track |
| 30 | District of Columbia | DC | D.C. Code § 28-3852 | 1500 | 0.47% | Name + SSN; Name + DL# / state ID#; Name + Financial Acct # + access code; Medical info; Health insurance info | 1500 | 399 | 194 | In the most expedient time possible and without unreasonable delay | 0 | Description of breach; type of info compromised; contact info for entity; toll-free numbers for credit reporting agencies and FTC; advice on fraud alerts/security freezes; if SSN: offer identity theft prevention services | Yes — AG | Concurrent with consumer notification | All breaches | Yes | Per statutory provisions | D.C. requires offer of identity theft prevention services if SSN compromised. | August 18, 2023 | August 18, 2023 | Planned — On Track |
| Date | Jurisdiction(s) | Action Type | Filing Recipient | Statutory Basis | Number of Affected Residents | Statutory Deadline Date | Days Remaining to Deadline | Status |
| August 14, 2023 | Connecticut | Regulatory Filing — AG | CT Attorney General, Consumer Protection Division (AAG Diane Marchetti) | Conn. Gen. Stat. § 36a-701b | 52114 | October 3, 2023 (60 days from Aug 4 determination) | 50 | Planned |
| August 14, 2023 | Connecticut | Regulatory Filing — Insurance Dept. | CT Insurance Department (Richard Nakamura, Financial Analysis Div., Cybersecurity Unit) | Conn. Gen. Stat. § 38a-999b | 52114 | August 7, 2023 (72 hours from determination) — extended by consultation | 0 | Planned — Coordinated filing |
| August 15, 2023 | Federal — HHS-OCR | Regulatory Filing — HIPAA Breach Notification | HHS Office for Civil Rights, Region I (Boston) | 45 C.F.R. § 164.408 | 41203 | October 3, 2023 (60 days from Aug 4 determination) | 49 | Planned |
| August 15, 2023 | Federal — HHS-OCR | Media Notice (HIPAA >500 individuals) | Prominent media outlets in affected states | 45 C.F.R. § 164.406 | 41203 | October 3, 2023 (60 days from determination) | 49 | Planned |
| August 16, 2023 | New York | Regulatory Filing — AG | NY Attorney General, Bureau of Internet and Technology (AAG Mark Petrosian) | N.Y. Gen. Bus. Law § 899-aa | 47831 | N/A — most expedient time possible | 0 | Planned |
| August 16, 2023 | New York | Regulatory Filing — DFS & Division of State Police | NY Dept. of Financial Services; NY Division of State Police | N.Y. Gen. Bus. Law § 899-aa | 47831 | N/A — most expedient time possible | 0 | Planned |
| August 16, 2023 | California | Regulatory Filing — AG (Sample Copy of Notice) | California Attorney General | Cal. Civ. Code § 1798.82 | 38206 | N/A — most expedient time possible | 0 | Planned |
| August 17, 2023 | Texas | Regulatory Filing — AG | TX Attorney General | Tex. Bus. & Com. Code § 521.053 | 29477 | October 3, 2023 (60 days from determination) | 47 | Planned |
| August 17, 2023 | Florida | Regulatory Filing — FDLE | FL Department of Law Enforcement | Fla. Stat. § 501.171 | 22913 | September 3, 2023 (30 days from determination) | 17 | Planned |
| August 17, 2023 | Pennsylvania | Regulatory Filing — AG | PA Attorney General | 73 Pa. Stat. § 2303 | 18640 | N/A — without unreasonable delay | 0 | Planned |
| August 17, 2023 | Illinois | Regulatory Filing — AG | IL Attorney General | 815 ILCS 530/10 | 16502 | N/A — most expedient time possible | 0 | Planned |
| August 17, 2023 | New Jersey | Regulatory Filing — Division of State Police | NJ Division of State Police | N.J. Stat. § 56:8-163 | 14388 | N/A — prior to consumer notification | 0 | Planned |
| August 17, 2023 | Ohio | Regulatory Filing — AG | OH Attorney General | Ohio Rev. Code § 1349.19 | 11743 | September 18, 2023 (45 days from determination) | 32 | Planned |
| August 17, 2023 | Massachusetts | Regulatory Filing — AG and DOCR | MA Attorney General; MA Dept. of Consumer Affairs and Business Regulation | Mass. Gen. Laws ch. 93H, § 3 | 10217 | N/A — as soon as practicable | 0 | Planned |
| August 17, 2023 | Colorado | Regulatory Filing — AG | CO Attorney General | Colo. Rev. Stat. § 6-1-716 | 2700 | September 3, 2023 (30 days from determination) | 17 | Planned |
| August 17, 2023 | Washington | Regulatory Filing — AG | WA Attorney General | Wash. Rev. Code § 19.255.010 | 2200 | September 3, 2023 (30 days from determination) | 17 | Planned |
| August 17, 2023 | New Hampshire | Regulatory Filing — AG | NH Attorney General | N.H. Rev. Stat. Ann. § 359-C:20 | 1500 | N/A — as soon as possible | 0 | Planned |
| August 18, 2023 | Virginia, Maryland, North Carolina, South Carolina, Indiana, Arizona, Oregon, Missouri, District of Columbia | Regulatory Filings — Various AGs | Various state AGs / regulators | Various state statutes | 30400 | Various | 0 | Planned |
| August 18, 2023 | All 29 states + D.C. | Consumer Notification Mailing Begins | 318,247 affected individuals via Clearfield Notification Services LLC | Various state statutes | 318247 | Various (earliest: 30 days — FL, CO, WA) | 0 | Planned |
| August 25, 2023 | Louisiana | Regulatory Filing — AG | LA Attorney General, Consumer Protection Section | La. Rev. Stat. § 51:3074 | 1900 | October 3, 2023 (60 days from determination) | 39 | Planned |
| August 25, 2023 | Iowa | Regulatory Filing — AG | IA Attorney General, Consumer Protection Division | Iowa Code § 715C.2 | 1704 | October 3, 2023 (60 days from determination) | 39 | Planned |
| September 15, 2023 | All 29 states + D.C. | Consumer Notification Mailing Completed | Final batch mailed via Clearfield Notification Services LLC | Various | 318247 | N/A | 0 | Target |
| Jurisdiction | Abbreviation | Affected Residents | Full Name | Date of Birth | Social Security Number | Driver's License Number | Financial Account Number | Payment Card Number | Health / Medical Information | Health Insurance Information | Diagnosis Codes / Treatment Info | Statutory Trigger Met? | Applicable Trigger Combination | Notification Letter Version |
| Connecticut | CT | 52114 | Yes | Yes | Yes | Yes | Yes (subset: 13,842) | Yes (subset) | Yes (subset: 6,735) | Yes (subset) | Yes (subset) | Yes | Name + SSN; Name + DL#; Name + Financial Acct#; PHI | General PII / Financial / PHI (as applicable per individual) |
| New York | NY | 47831 | Yes | Yes | Yes | Yes | Yes (subset: 12,713) | Yes (subset) | Yes (subset: 6,177) | Yes (subset) | Yes (subset) | Yes | Name + SSN; Name + DL#; Name + Financial Acct# + access code; PHI | General PII / Financial / PHI (as applicable per individual); NY SHIELD Act format |
| California | CA | 38206 | Yes | Yes | Yes | Yes | Yes (subset: 10,157) | Yes (subset) | Yes (subset: 4,938) | Yes (subset) | Yes (subset) | Yes | Name + SSN; Name + DL#/CA ID#; Name + Financial Acct# + access code; Medical info | CA-Specific Letter (Cal. Civ. Code § 1798.82(d) format); PHI version with CMIA language |
| Texas | TX | 29477 | Yes | Yes | Yes | Yes | Yes (subset: 7,835) | Yes (subset) | Yes (subset: 3,808) | Yes (subset) | Yes (subset) | Yes | Name + SSN; Name + DL#/govt. ID#; Name + Financial Acct# + access code | General PII / Financial / PHI (as applicable per individual) |
| Florida | FL | 22913 | Yes | Yes | Yes | Yes | Yes (subset: 6,092) | Yes (subset) | Yes (subset: 2,961) | Yes (subset) | Yes (subset) | Yes | Name + SSN; Name + DL#/govt. ID#; Name + Financial Acct# + access code; Medical history; Health insurance info | General PII / Financial / PHI (as applicable per individual) |
| Pennsylvania | PA | 18640 | Yes | Yes | Yes | Yes | Yes (subset: 4,954) | Yes (subset) | Yes (subset: 2,408) | Yes (subset) | Yes (subset) | Yes | Name + SSN; Name + DL#/state ID#; Name + Financial Acct# + access code | General PII / Financial / PHI (as applicable per individual) |
| Illinois | IL | 16502 | Yes | Yes | Yes | Yes | Yes (subset: 4,387) | Yes (subset) | Yes (subset: 2,132) | Yes (subset) | Yes (subset) | Yes | Name + SSN; Name + DL#/state ID#; Name + Financial Acct# + access code; Medical info; Health insurance info | General PII / Financial / PHI (as applicable per individual) |
| New Jersey | NJ | 14388 | Yes | Yes | Yes | Yes | Yes (subset: 3,825) | Yes (subset) | Yes (subset: 1,859) | Yes (subset) | Yes (subset) | Yes | Name + SSN; Name + DL#/state ID#; Name + Financial Acct# + access code | General PII / Financial / PHI (as applicable per individual) |
| Ohio | OH | 11743 | Yes | Yes | Yes | Yes | Yes (subset: 3,122) | Yes (subset) | Yes (subset: 1,517) | Yes (subset) | Yes (subset) | Yes | Name + SSN; Name + DL#/state ID#; Name + Financial Acct# + access code | General PII / Financial / PHI (as applicable per individual) |
| Massachusetts | MA | 10217 | Yes | Yes | Yes | Yes | Yes (subset: 2,717) | Yes (subset) | Yes (subset: 1,320) | Yes (subset) | Yes (subset) | Yes | Name + SSN; Name + DL#; Name + Financial Acct# + access code | MA-Specific Letter (201 CMR 17.00 format) |
| Georgia | GA | 4812 | Yes | Yes | Yes | Yes | Yes (subset: 1,279) | Yes (subset) | Yes (subset: 622) | Yes (subset) | Yes (subset) | Yes | Name + SSN; Name + DL#/state ID#; Name + Financial Acct# + password/access code | General PII / Financial / PHI (as applicable per individual) |
| Virginia | VA | 4500 | Yes | Yes | Yes | Yes | Yes (subset: 1,196) | Yes (subset) | Yes (subset: 581) | Yes (subset) | Yes (subset) | Yes | Name + SSN; Name + DL#/state ID#; Name + Financial Acct# + access code; Medical info; Health insurance info | General PII / Financial / PHI (as applicable per individual) |
| Maryland | MD | 4200 | Yes | Yes | Yes | Yes | Yes (subset: 1,116) | Yes (subset) | Yes (subset: 542) | Yes (subset) | Yes (subset) | Yes | Name + SSN; Name + DL#/state ID#; Name + Financial Acct# + access code; Health info; Health insurance info | General PII / Financial / PHI (as applicable per individual) |
| North Carolina | NC | 3900 | Yes | Yes | Yes | Yes | Yes (subset: 1,037) | Yes (subset) | Yes (subset: 504) | Yes (subset) | Yes (subset) | Yes | Name + SSN; Name + DL#/state ID#; Name + Financial Acct# + access code | General PII / Financial / PHI (as applicable per individual) |
| South Carolina | SC | 3600 | Yes | Yes | Yes | Yes | Yes (subset: 957) | Yes (subset) | Yes (subset: 465) | Yes (subset) | Yes (subset) | Yes | Name + SSN; Name + DL#/state ID#; Name + Financial Acct# + access code | General PII / Financial / PHI (as applicable per individual) |
| Michigan | MI | 3400 | Yes | Yes | Yes | Yes | Yes (subset: 904) | Yes (subset) | Yes (subset: 439) | Yes (subset) | Yes (subset) | Yes | Name + SSN; Name + DL#/state ID#; Name + Financial Acct# + access code | General PII / Financial / PHI (as applicable per individual) |
| Minnesota | MN | 3200 | Yes | Yes | Yes | Yes | Yes (subset: 851) | Yes (subset) | Yes (subset: 413) | Yes (subset) | Yes (subset) | Yes | Name + SSN; Name + DL#/state ID#; Name + Financial Acct# + access code | General PII / Financial / PHI (as applicable per individual) |
| Indiana | IN | 3000 | Yes | Yes | Yes | Yes | Yes (subset: 798) | Yes (subset) | Yes (subset: 388) | Yes (subset) | Yes (subset) | Yes | Name + SSN; Name + DL#/state ID#; Name + Financial Acct# + access code | General PII / Financial / PHI (as applicable per individual) |
| Wisconsin | WI | 2800 | Yes | Yes | Yes | Yes | Yes (subset: 744) | Yes (subset) | Yes (subset: 362) | Yes (subset) | Yes (subset) | Yes | Name + SSN; Name + DL#/state ID#; Name + Financial Acct# + access code | General PII / Financial / PHI (as applicable per individual) |
| Colorado | CO | 2700 | Yes | Yes | Yes | Yes | Yes (subset: 718) | Yes (subset) | Yes (subset: 349) | Yes (subset) | Yes (subset) | Yes | Name + SSN; Name + DL#/state ID#; Name + Financial Acct# + access code; Medical info; Health insurance info; Biometric | General PII / Financial / PHI (as applicable per individual) |
| Arizona | AZ | 2500 | Yes | Yes | Yes | Yes | Yes (subset: 665) | Yes (subset) | Yes (subset: 323) | Yes (subset) | Yes (subset) | Yes | Name + SSN; Name + DL#/state ID#; Name + Financial Acct# + access code; Health insurance info; Medical info | General PII / Financial / PHI (as applicable per individual) |
| Oregon | OR | 2300 | Yes | Yes | Yes | Yes | Yes (subset: 612) | Yes (subset) | Yes (subset: 297) | Yes (subset) | Yes (subset) | Yes | Name + SSN; Name + DL#/state ID#; Name + Financial Acct# + access code; Medical info; Health insurance info; Biometric | General PII / Financial / PHI (as applicable per individual) |
| Washington | WA | 2200 | Yes | Yes | Yes | Yes | Yes (subset: 585) | Yes (subset) | Yes (subset: 284) | Yes (subset) | Yes (subset) | Yes | Name + SSN; Name + DL#/state ID#; Name + Financial Acct# + access code; Medical info; Health insurance info; Full DOB | General PII / Financial / PHI (as applicable per individual) |
| Tennessee | TN | 2100 | Yes | Yes | Yes | Yes | Yes (subset: 558) | Yes (subset) | Yes (subset: 271) | Yes (subset) | Yes (subset) | Yes | Name + SSN; Name + DL#/state ID#; Name + Financial Acct# + access code | General PII / Financial / PHI (as applicable per individual) |
| Letter Version | Description | Data Elements Covered | Applicable States | Estimated Recipients | Credit Monitoring Offer | Date Finalized | Drafted By | Reviewed By | Notes |
| Version 1 — General PII | Standard notification for individuals whose PII (name, DOB, SSN, DL#) was compromised — no financial data or PHI | Name, Date of Birth, Social Security Number, Driver's License Number | All 29 states + D.C. (except CA-specific and MA-specific recipients receive state-tailored versions) | 192425 | 24 months complimentary credit monitoring and identity theft protection via Clearfield Notification Services LLC | August 10, 2023 | Alan Burke; Sara Hendricks | Kevin Ostrowski | Base template; adapted for state-specific requirements where needed |
| Version 2 — SSN + Financial Data | Enhanced notification for individuals whose financial information (bank account #, payment card #) was also compromised | Name, DOB, SSN, DL#, Bank Account Number, Payment Card Number | All 29 states + D.C. (except CA and MA recipients receive tailored versions) | 84619 | 24 months complimentary credit monitoring and identity theft protection; additional guidance on monitoring financial accounts | August 10, 2023 | Alan Burke; Sara Hendricks | Kevin Ostrowski | Includes enhanced protective steps for financial data exposure |
| Version 3 — PHI (HIPAA-Compliant) | HIPAA-compliant notification for individuals whose protected health information was compromised | Name, DOB, SSN, DL#, Health Conditions, Diagnosis Codes, Treatment Information (from workers' compensation and health-related claims) | All 29 states + D.C. (recipients in PHI subset) | 41203 | 24 months complimentary credit monitoring and identity theft protection; information about HHS-OCR complaint process | August 10, 2023 | Alan Burke; Sara Hendricks | Kevin Ostrowski | Compliant with 45 C.F.R. § 164.404(c) content requirements |
| Version 4 — California-Specific | Adapted for Cal. Civ. Code § 1798.82(d) prescribed format and CMIA requirements where applicable | All compromised data elements applicable to CA residents | California only | 38206 | 24 months complimentary credit monitoring and identity theft protection; identity theft prevention and mitigation services | August 12, 2023 | Sara Hendricks | Alan Burke; Kevin Ostrowski | Prescribed format per California statute; CMIA language for PHI subset |
| Version 5 — Massachusetts-Specific | Adapted for Mass. Gen. Laws ch. 93H, § 3 and 201 CMR 17.00 prescribed format | All compromised data elements applicable to MA residents | Massachusetts only | 10217 | 24 months complimentary credit monitoring and identity theft protection | August 12, 2023 | Sara Hendricks | Alan Burke; Kevin Ostrowski | Includes required statutory language re: right to obtain police report, right to request security freeze |
| Version 6 — Substitute Notice / Website Posting | Website posting and media publication for individuals who cannot be reached via direct mail (undeliverable addresses) | General description of all compromised data elements; no individual-specific data | All 29 states + D.C. (as needed for undeliverable notices) | 0 | Instructions for enrolling in complimentary 24-month credit monitoring program | August 14, 2023 | Sara Hendricks | Alan Burke; Kevin Ostrowski | To be deployed only if direct mail is returned undeliverable and substitute notice thresholds are met per applicable state law |