Who to notify after a data breach in the USA depends on what kind of company you are and where the affected people live, and an insurer's list is longer than almost anyone's. It starts with insurance commissioners: the home state's always, any other state where 250 or more affected residents live if that state adopted the NAIC model law, and New York's Department of Financial Services within 72 hours. It continues with every affected person, under the breach law of the state that person lives in; with attorneys general and other state agencies once a state's count threshold is passed; with the nationwide credit bureaus above a higher threshold; and with partners such as the independent producers who sold the policies. No federal statute sets that list for an insurer. Fifty states and a handful of territories set it, each its own way.
Working out that list for one incident, with a deadline and a draft for every notice, is the job of data breach notification management, and it is hard for a reason that has little to do with law: every notice waits on a finding that someone else owns. Botminds' Data Breach Notification Management is software in which five AI agents read the vendor's notice and the forensic report, place each affected person in a state, apply each state's breach law and insurance data security law, and draft every notice, while named people at the insurer make the determinations and sign. The examples on this page come from its fictional sample incident: Wrenfield Mutual, whose claims-mail scanning vendor was hit by ransomware, exposing 48,016 people in 20 states.
The four numbers that set an insurer's notice list
28
jurisdictions that have adopted the NAIC Insurance Data Security Model Law (#668)
NAIC state page, Summer 2026
250
residents of a state who bring in its commissioner under the model law, and the Texas attorney general
72hours
for the New York superintendent, counted from determining the incident
209breaches
over 500 people reported to Washington’s attorney general in one year, affecting just over 8 million residents
Who must an insurer notify after a data breach?
An insurer notifies five kinds of recipient: insurance regulators, the affected people, attorneys general and other state agencies, the credit bureaus, and its own business partners. Two separate bodies of state law produce that list. The first is insurance law. The NAIC Insurance Data Security Model Law requires a licensee to notify the commissioner no later than 72 hours after determining that a cybersecurity event occurred, when the state is its home state or 250 or more of its residents are involved; New York runs its own version under 23 NYCRR Part 500. The second is breach law: state statutes, such as those of Texas and Florida, that tell any business that loses residents' personal information when to tell them, and whom else to tell.
Most companies live only under the second. An insurer lives under both because federal law sends its privacy oversight to the states. The Gramm-Leach-Bliley Act assigns enforcement of its privacy rules for insurers to the insurance regulator of the state where each is domiciled, which is why the Federal Trade Commission's rule that financial companies report a breach to it within 30 days is not an insurer's rule, and why a state commissioner, not a federal agency, is usually the first regulator an insurer calls.
The two bodies of law also count different people. An insurance data security law speaks of "consumers", and the model defines the word to include "applicants, policyholders, insureds, beneficiaries, claimants, and certificate holders". A breach law speaks of residents. Both reach people who never bought a policy: injured third-party claimants, workers' compensation claimants, beneficiaries. In the sample incident, many of the 48,016 people were claimants whose only link to Wrenfield was a claim file.
The party map: who waits on whom
Every recipient on an insurer's list waits on a finding that someone else produces. The commissioner notices wait on a determination that only counsel can make. The letters wait on the data review that tells you who was exposed and where they live. The attorney general notices wait on the counts per state, and the credit bureau notices wait on the mailing schedule. Seen this way, the list is less a set of deadlines than a chain of hand-offs, and a missed deadline is usually a hand-off that came late.
Who to notify after a data breach, and what each notice waits for
| Who | The law that names them | When they are owed a notice | The clock | What the notice waits for |
|---|---|---|---|---|
| Commissioner of the home state | The law that names themInsurance data security law (NAIC Model #668 §6.A(1)) | When they are owed a noticeAny cybersecurity event, whatever the size | The clock72 hours from the determination in the model; 3 business days in several adopting states | What the notice waits forCounsel’s determination that a cybersecurity event occurred |
| Commissioners of other states | The law that names themModel #668 §6.A(2), where adopted | When they are owed a notice250 or more of the state’s residents, plus a notice owed elsewhere or likely material harm | The clockSame as above | What the notice waits forThe residence count from the data review |
| New York Department of Financial Services | The law that names them23 NYCRR 500.17(a) | When they are owed a noticeA cybersecurity incident at a licensed company, its affiliate or its vendor | The clock72 hours from determining the incident | What the notice waits forThe determination; not the people list |
| Each affected person | The law that names themThe breach law of the state the person lives in | When they are owed a noticeThe elements exposed count as personal information there | The clock30 days (FL, CA, NY, WA) to 60 days (TX, DE); some states give no number | What the notice waits forThe data review: who, where, which elements |
| Attorneys general and state agencies | The law that names themThe same breach laws | When they are owed a noticeA count: 250 (TX), 500 or more (FL), over 500 (WA, CA, DE), any at all (NY, MA) | The clockOften the residents’ deadline or tied to it | What the notice waits forThe count per state and the final letter |
| Nationwide credit bureaus | The law that names themThe same breach laws | When they are owed a noticeAbove 1,000 (FL), 5,000 (NY) or 10,000 (TX) people | The clockWithout unreasonable delay | What the notice waits forThe mailing schedule: timing, distribution, content |
| Producers of record; ceding insurers | The law that names themModel #668 §6.F and §6.E | When they are owed a noticeCustomers who bought through an independent producer; a reinsurer’s event | The clockAs directed by the commissioner; 72 hours for a reinsurer | What the notice waits forPolicy records that link each person to a producer or cedant |
The right-hand column is where the time goes. In the sample incident the vendor's notice reached Wrenfield at 17:30 on Monday 21 September, regulatory counsel recorded the determination at 15:10 the next day, and the data review that placed people in states was not final until 9 October. Each of those three dates starts a different set of clocks, and the person who owns each finding is rarely the person who owns the notice.
Insurance commissioners: the notice most companies never owe
The commissioner notice is the one that sets an insurer apart, and it is owed far sooner than a letter. Under the model law the home state's commissioner hears of every cybersecurity event the licensee determines has happened; other states' commissioners hear when 250 or more of their residents are involved and the event is either reportable to another government body or reasonably likely to harm a resident or the insurer's operations. The model asks for thirteen items, from the date of the event to a named contact, and a duty to keep updating them, set out in detail in the Insurance Data Security Model Law, section by section.
The 72 hours in the model is not universal even among adopters: Delaware, Virginia and Iowa give three business days and Minnesota five, as the states that adopted the model page shows. States outside the model run their own rules. New York's superintendent must hear within 72 hours of the determination that a cybersecurity incident occurred "at the covered entity, its affiliates, or a third-party service provider". Washington's insurance commissioner must be told, under its own rule, within two business days after the insurer determines that consumers must be notified. In the sample incident, eight commissioners were owed a notice and one was not: Delaware, where only 174 residents were in the files.
Residents: the law of the state each person lives in
A person is owed a letter under the breach law of the state where that person lives, not where the insurer is based or where the data was stored. That one rule turns a single incident into as many sets of rules as there are states of residence, and each state answers the same questions differently: what counts as personal information, whether a harm test can excuse the notice, how long you have, and what the letter must and must not say.
The differences bite hardest on insurers because claim files hold health information. Florida counts "information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional" as personal information, and a health insurance policy number too. Texas counts information about a person's health, health care or payment for it. Other states count only the classic elements: Social Security numbers, driver's licence numbers and financial accounts. In the sample incident 2,206 claimants whose only exposed element was medical information lived in states that do not count it, so they were not owed a letter, and the plan said why for each of them.
The deadline varies as much as the definition. Florida, California, New York and Washington give 30 days; Texas and Delaware give 60; Massachusetts says "as soon as practicable and without unreasonable delay" and names no number. The state-by-state reading is the subject of data breach notification laws by state.
Who do you report a data breach to besides the people affected?
Besides the affected people, a breach is reported to state attorneys general or consumer protection agencies, sometimes to the state police, and to the nationwide credit bureaus, each once a count threshold is passed. The thresholds are what turn a list of 20 states into a list of 59 notices, as in the sample incident.
New York is the broadest. Its breach law says that "in the event that any New York residents are to be notified, the person or business shall notify the state attorney general, the department of state, the division of state police, and the department of financial services", the last only for companies the Department regulates. There is no minimum: one New Yorker brings in four agencies for a licensed insurer. Massachusetts also has no minimum and adds its Office of Consumer Affairs and Business Regulation, which then names any further agency or credit bureau to tell.
Elsewhere a count decides. Texas wants its attorney general told through an online form within 30 days of the determination when at least 250 Texans are involved. Florida's Department of Legal Affairs hears of a breach affecting 500 or more Floridians within 30 days. Washington's attorney general hears of one affecting more than 500 residents within 30 days of discovery, and California's receives a sample copy of the letter for more than 500 residents. The credit bureaus come in above 1,000 people in Florida, above 5,000 in New York and above 10,000 in Texas, and they are told the timing, distribution and content of the letters, not the names.
Who to notify after a data breach in California
In California an insurer notifies affected residents within 30 calendar days of discovering the breach and, if more than 500 Californians are notified, sends the attorney general a sample copy of the letter within 15 calendar days of notifying them. The 30-day limit is new: a 2025 amendment, Senate Bill 446, replaced the old "most expedient time possible" standard with a fixed number from 1 January 2026, while keeping room for a delay requested by law enforcement or needed to establish the scope of the breach.
What California does not have is a commissioner clock of the model-law kind. The NAIC's state page lists no adoption of the model for California; it shows Department of Insurance regulations dating from 2002 and the state's consumer privacy statute as related activity. The letter itself must carry the title "Notice of Data Breach" and set headings, and a health insurer that complies with the federal HIPAA notice rules is treated as meeting the content requirement, though not the rest of the section.
Producers, ceding insurers and the vendor itself
An insurer's business partners are on the list too, and they are the notices most often forgotten. Where customers bought through independent agents, the model law says the insurer "shall notify the producers of record of all affected Consumers as soon as practicable as directed by the Commissioner", unless it lacks current producer-of-record information for a person. A reinsurer that suffers an event involving a ceding company's data notifies its affected ceding insurers and its home commissioner within 72 hours, and the ceding insurers, which have the direct relationship, send the consumer notices.
The chain also runs the other way. A vendor that holds an insurer's data must tell the insurer: Texas says "immediately after discovering the breach", California "immediately following discovery", and Florida gives a third-party agent no more than 10 days. In the sample incident the vendor took eight days from detecting the ransomware on Sunday 13 September to telling Wrenfield on Monday 21 September, and the insurer's own clocks started only then.
Federal regulators: health, securities and law enforcement
No general federal breach law covers an insurer, but three federal channels can still apply. A health insurer is a covered entity under HIPAA, which requires notice to individuals "without unreasonable delay and in no case later than 60 calendar days after discovery", notice to the Secretary of Health and Human Services, and notice to prominent media for a breach involving more than 500 residents of a state. A publicly traded insurer that determines an incident is material files an Item 1.05 Form 8-K generally within four business days of that determination. And law enforcement is told early, both because investigators can act sooner and because most breach statutes let a police request delay the letters.
Each of these runs on its own trigger. HIPAA counts from discovery, the SEC from a materiality decision, the insurance laws from a determination, and the state breach laws from discovery or determination depending on the state. An insurer that writes health business and is listed can owe all of them for one incident.
When to report a data breach: the first month, drawn to scale
Report to the commissioners first, within days; then to the residents and the agencies tied to them, within weeks. The sample incident shows how uneven those clocks are, and how much of the calendar had already gone before the insurer knew anything.
One vendor breach, from the intrusion to the last 60-day letter
- Intruder on the vendor’s server2–9 Sep
- Unnoticed3 d
- Vendor investigates13–21 Sep
- Eight notices sent 23–24 Sep3 d
- Data review, drafting, counselto 15 Oct
- Held, released, mailed 20 Oct
- Margin, 2 days
- Batch 2 mailed 2 Nov41 d
- Margin to 21 Nov19 d
The first lane is the one no insurer controls. Nineteen days passed between the start of the intrusion and the vendor's notice, which is why the model law starts a licensee's clock from the vendor's notice, not from the intrusion. Once it started, the commissioner notices took three days. The letters took four weeks, most of them spent waiting for the data review to say who lived where.
Who inside the insurer holds each answer
Four people inside an insurer carry most of an incident, and the hand-offs between them are where days are lost. The CISO knows the facts of the intrusion. Regulatory counsel decides when an event has been determined and signs the commissioner notices. The chief privacy officer owns the letters and the plan. Claims operations holds the addresses, and the hard cases: minors, deceased claimants and people with no usable address.
The same incident, seen by the people who owe its notices
Today
Builds the notice matrix in a spreadsheet from outside counsel’s 50-state survey, after the people list arrives.
With agents
Sees every regulator and person owed, each with its deadline and draft, and approves the few that need her.
Still theirs: Approval and release of every letter
Today
Decides the day the clock starts, then rebuilds the facts behind it for each commissioner.
With agents
Records the determination herself and signs commissioner notices drafted from the facts, each with its source.
Still theirs: The determination and every harm-based exception
Today
Has the forensic facts by noon, but not twenty state laws.
With agents
Supplies the facts and the exposure window once; every clock is built from them.
Still theirs: The forensic findings
Today
Half the people are claimants, not policyholders, and still need a letter at the right address.
With agents
Gets the special cases as a list: 612 minors, 141 deceased claimants, 1,088 addresses to find.
Still theirs: Addresses, guardians and estates
A useful test of any incident response plan is to ask, for each row of the party map above, who produces the finding the notice waits on and how it reaches the person who sends the notice. If the answer is an email, the clock is being run by an inbox.
Where Data Breach Notification Management fits
The solution turns the party map into a plan for one incident. Each affected state becomes a branch, and each notice owed in that state becomes a leaf with its own countdown, its statute and a draft. In the sample incident the plan held 59 notices across 20 states: 53 owed and 6 not owed, each "not owed" shown with the count that fell short of a threshold.
Every regulator and person owed, each on its own clock
Every notice that goes out is kept with its proof. A notice counts as sent only when a portal receipt, a confirmation number or a mailing job shows it went, which is what an examiner or an attorney general asks for when the question is not whether you notified but when.
Who was told, when, and the proof
What the solution does not do matters as much. It does not decide that a cybersecurity event has been determined; counsel records that. It does not decide that a harm test excuses a notice; counsel does. It never sends anything without a named person's signature. And the rules it applies are the insurer's own, kept current by its counsel: the agents cite them, they do not write them. For the commissioner's 72 hours in particular, see what each late hour costs.
Questions people ask
What should you do first after a data breach?
Contain it and find out what happened. The model law requires a prompt investigation that determines whether an event occurred, its nature and scope, which information was involved, and what will restore security. Bring in counsel at once, because the date counsel determines the event occurred starts the commissioner clocks.
Who do you contact for data breach notification in each state?
Usually the attorney general's office, through a form on its website, once the state's threshold is passed: Texas at 250 residents, Florida at 500 or more and Washington above 500. New York adds its Department of State, State Police and, for licensed companies, the Department of Financial Services. An insurer also contacts the insurance department of its home state and of each adopting state with 250 or more affected residents.
Does every breach have to be reported to the insurance commissioner?
Not every one. Under the model law the home state's commissioner hears of every cybersecurity event the licensee determines occurred, but other states' commissioners only when 250 or more of their residents are involved and the event is reportable elsewhere or likely to cause material harm. The model excludes encrypted data taken without the key, and data that was returned or destroyed without being used or released.
Do you have to notify the credit bureaus after a data breach?
Only above a state's threshold, and only about the notices, not the people. Florida requires it when more than 1,000 people are notified at a single time, New York above 5,000 and Texas above 10,000. The bureaus are told the timing, distribution and content of the letters.
Is there a federal data breach notification law in the USA?
There is no general one. Federal rules cover sectors: HIPAA for health insurers and other covered entities, the SEC's Form 8-K for material incidents at listed companies, and the FTC's Safeguards Rule for financial companies under the FTC's jurisdiction. Gramm-Leach-Bliley leaves an insurer's privacy enforcement to its home state's insurance regulator.
Are people in states with fewer than 250 affected residents still owed a letter?
Yes. The 250 threshold decides whether a state's commissioner or attorney general hears about the breach, not whether residents are told. In the sample incident Delaware's 174 residents were not reported to its commissioner, but each of them was owed a letter within 60 days.