The Apology Email Is Late on Purpose

Here's the number that should annoy you: in Verizon's 2024 Data Breach Investigations Report, attackers often need only minutes to crack open an inbox, but defenders took a median of 55 days just to patch the holes being exploited. Fifty-five days. Nearly two months of open door while the paperwork catches up. And that's before anyone drafts the email that eventually lands in your inbox, starting with "We take your privacy seriously."

They do not. What they take seriously is the statute.

Most people assume breach notification runs on some clock measured in hours, the way a fire alarm works. It doesn't. California's breach law, Civil Code 1798.82—the granddaddy that most other states modeled theirs after—requires disclosure "in the most expedient time possible and without unreasonable delay." Sounds urgent. Then it carves out room for "the legitimate needs of law enforcement" and the time needed "to determine the scope of the breach and restore the reasonable integrity" of the system. Translation: as long as you can argue you were still investigating, the clock hasn't really started.

Federal rules aren't much tighter outside of specific sectors. Medical breaches under HIPAA give covered entities up to 60 days. The SEC's newer rule for public companies demands disclosure within four business days—but only after the company decides the incident is "material," and that determination has no hard deadline either. It's deadlines all the way down, and every one of them is anchored to a judgment call the breached company gets to make.

So the delay isn't incompetence. It's architecture.

The second tell is the phrase you'll see in nearly every notice: "we have no evidence that your information has been misused." Read that slowly. It is not a statement about whether your data is safe. It's a statement about what the company looked for and didn't find. Those are wildly different things. A stolen credential dump can sit on a forum for months, get bought, get tested against a dozen other sites, and drain an account that has nothing to do with the breached company—and none of that activity shows up in their logs. "No evidence of misuse" is the corporate equivalent of "I didn't see anyone take it," offered by the person who was looking the other way.

By the time the notice arrives, your email and password have had a full season on the open market. Credential-stuffing is automated and cheap; the lists get resold and recombined constantly. The breach letter is a historical document.

Which is why you should treat the apology email as a receipt, not a warning. The protective move already happened—or didn't—weeks earlier. The things that actually help are boring and don't wait for anyone's legal department: a unique password per site so one leak can't domino, a password manager so you'll actually do that, and two-factor authentication using an app or a hardware key instead of SMS. Check your own address against Have I Been Pwned whenever you're curious, not when a company finally gets around to telling you.

And when the notice does land, resist the free credit monitoring they dangle as a peace offering. It's a year of watching a horse that left the barn in the spring. The damage, if there's going to be any, tends to run on a faster clock than the one the lawyers set. The letter is just everyone's paperwork finally agreeing to meet.

File it. Change the password. Move on. They already did.