Same Breach, Two States, Two Different Letters. Who Decided What Yours Says

Two households, one in Hartford and one outside Nashville, opened envelopes from the same medical billing vendor in the same week. The letters described the same intrusion, named the same date range, and used several identical paragraphs. Then they diverged. One offered enrollment in credit monitoring at no cost for a defined period, with a code and a deadline. The other described the incident, recommended vigilance, and offered nothing to sign up for. Neither household had done anything different. Neither was more or less exposed. The difference was written into the letters weeks earlier by people neither reader will ever speak to.

The letter is a legal document drafted by people you never hired

By the time a notice reaches a mailbox, it has passed through at least four sets of hands, and none of them work for the recipient. Outside breach counsel decides what the company is legally obligated to say and, more to the point, what it is not obligated to say. A digital forensics firm, usually engaged through that counsel so the work sits under privilege, determines what data the intruder could have reached and what can be proven about what was actually taken. A notification vendor prints and mails at volume, often on a fixed template. Somewhere in the chain, a state attorney general's office receives a copy.

Understanding that chain changes how the letter reads. Phrases that sound evasive are usually precise. When a notice says information "may have been accessible," the forensic firm has established the intruder had a path to that data but no evidence of exfiltration survived in the logs. That is a real finding, not a hedge. When a notice lists categories of data rather than your specific records, the company is describing the population of the incident because per-person review would have delayed the mailing past the deadline its counsel was working against. The letter is the compressed output of a long, careful process, and it can be decompressed.

Why the same facts produce different offers across a state line

Every state has its own breach notification statute, and they disagree with each other in ways that show up directly on the page. They disagree on what counts as personal information: some states stop at name plus Social Security number, driver's license number, or financial account credentials, while others sweep in health insurance details, biometric records, medical information, and username-and-password pairs. They disagree on timing, with some statutes setting a fixed outer limit in days from discovery and others requiring notice in the most expedient time possible. They disagree on whether the attorney general must be told, at what threshold, and whether that filing becomes a public posting.

The credit monitoring offer is the clearest regional tell. A handful of states require a company to offer identity theft prevention services at no cost for a set minimum period when Social Security numbers are involved. Most states do not, which means the offer becomes a business decision rather than a legal one. A company facing an obligation in two or three states will sometimes extend the same offer to everyone, because running parallel mailings is expensive and the optics of a two-tier response are poor. Sometimes it will not. The Hartford letter carried an enrollment code because a statute required one. The Tennessee letter did not, and that was lawful.

The public posting matters more than most recipients realize. Several state attorney general offices publish the notices they receive in a searchable database, including the sample letter and the reported number of affected residents. That is a free, authoritative second source. If your own state does not maintain such a database, the notice filed in a state that does will often be the same underlying document, and it will tell you what the company said when it was talking to a regulator instead of to you.

When a second opinion is worth an hour of someone's time

Most breach letters do not need professional review. Freeze your credit at all three bureaus, take the monitoring if it is offered, and move on. The cases that justify paying for a second look share a few features: the exposed data includes something that cannot be reissued, such as a Social Security number, a date of birth, or clinical records; you are a party to something time-sensitive like a mortgage application, a security clearance, or a custody matter; or the notice arrives from a company you cannot identify and no reasonable search explains the relationship.

Tell the reviewer what to look for rather than asking for a general opinion. Ask which data elements in the letter trigger obligations under your own state's statute, and whether the offer you received meets the minimum that statute sets. Ask whether the notice was filed with your attorney general and, if so, whether the filed version says anything the mailed version omits, particularly about the discovery date and the gap between intrusion and detection. Ask whether any regulated category is implicated, since health data, financial account data, and student records each carry their own federal overlay. Finally, ask what your specific deadlines are.

The federal floor underneath the state patchwork

The Federal Trade Commission oversees consumer identity theft response nationally and maintains the recovery process most attorneys will point you toward, which sits alongside, not instead of, whatever your state provides. That gives every recipient a baseline set of steps regardless of which envelope they got. State law then adds to it, unevenly but usefully, and the additions are worth finding rather than assuming you received them automatically.

The Hartford household enrolled, froze all three files, and closed the matter in an afternoon. The Nashville household paid for one hour with an attorney, learned that the vendor had filed a more detailed notice in a neighboring state, and used that filing to establish a nine-week detection gap the mailed letter never mentioned. Same breach. Same week. One question apart.