Notice-letter delay: how long companies take to notify after a breach

What the question is and what the documents can answer

This guide compares the dates in two notice letters filed with the California Attorney General against the notification timing rules in the documents provided. The letters come from Inner City Education Foundation (ICEF) and from Sarasota US Topco, Inc. d/b/a Sarku Japan. The legal text provided is Washington's RCW 19.255.010, plus a California Attorney General page on breach reporting.

One limit applies up front. The documents do not include California's statute text on timing, so this guide cannot say what California's own deadline is. The California page, discussed below, does not state one. The only numeric deadline in the documents is Washington's.

What the two letters say about dates

ICEF's letter is dated October 16, 2026. The letter says ICEF became aware of suspicious activity on its network on September 30, 2024.

The letter says the investigation determined that an unauthorized actor gained access to certain ICEF systems between August 4 and September 29, 2024.

ICEF explains the gap this way: it says it conducted a "comprehensive and time-intensive review to determine what information was involved and to whom such information relates." The letter also states that the notice has not been delayed by law enforcement.

Sarku Japan's letter is dated October 27, 2026. It says Sarku Japan discovered on September 7, 2026 that parts of its systems were inaccessible. The text of the filing available to us is partly garbled, so the cause and scope of the incident are not fully readable.

Counting the days

Using only the dates the letters give, the arithmetic is as follows. This is our calculation from the stated dates, not a figure either company reports.

• ICEF: from September 30, 2024 (awareness) to October 16, 2026 (letter date) is about 25 and a half months, a little over two years.
• Sarku Japan: from September 7, 2026 (discovery) to October 27, 2026 (letter date) is 50 days.

Two letters cannot show what is typical. They show a range, and the two incidents differ. In the ICEF letter, the stated reason for the gap is a review of what information was involved and whom it concerned. In the Sarku Japan filing, the legible text gives no reason for the 50-day interval.

The letters also differ on when the clock starts. ICEF gives an awareness date and a separate window of unauthorized access. Sarku Japan gives a discovery date only, in the readable text.

What Washington's deadline says

Washington's statute sets the one numeric consumer deadline in these documents. It states that notification to affected consumers must be made in the most expedient time possible, without unreasonable delay, and no more than thirty calendar days after the breach was discovered.

The same sentence lists two exceptions: a delay at the request of law enforcement, or a delay due to measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

The statute also separately allows delay when a law enforcement agency determines that notification will impede a criminal investigation.

For breaches affecting more than five hundred Washington residents, the statute adds that the attorney general must be notified no more than thirty days after the breach was discovered.

How the filings compare with that deadline

The comparison is a test of the dates against Washington's 30-day figure only. The documents do not say that either letter went to Washington residents, so this does not establish that Washington law applied to either company.

• Sarku Japan's 50 days is longer than 30 days. The legible text does not state a reason, so the documents do not show whether an exception such as scope determination would apply.
• ICEF's gap of a little over two years is far longer than 30 days. ICEF states it did not have a law enforcement delay, so the law enforcement exception is not claimed in the letter. The letter does describe a review to determine what information was involved, which is a different description from the statute's exception language about determining the scope of the breach, and the documents do not say whether the two match.

Whether either delay was lawful depends on the statute that applies and on facts these documents do not contain. This guide makes no finding on that.

What the California page says, and does not say

The California Attorney General page states that California law requires a business or state agency to notify any California resident whose unencrypted personal information was acquired, or reasonably believed to have been acquired, by an unauthorized person.

The page also says that a business required to notify more than 500 California residents from a single breach must electronically submit a single sample copy of the notice to the Attorney General.

The readable text of the page gives no number of days for notifying residents. That is why this guide does not compare the letters to a California deadline. The page also explains why these letters appear in the Attorney General's public record: they are the sample copies the California filing requirement describes.

What the dates tell a reader of the log

When reading a filing, the useful items are the discovery date, the letter date, and any stated reason for the gap. Washington's statute requires its consumer notices to include a time frame of exposure, if known, with the date of the breach and the date of discovery. ICEF's letter gives both an access window and an awareness date. Sarku Japan's readable text gives a discovery date.

The two letters sit at opposite ends of a wide range: 50 days and more than two years. Neither number settles how long companies take in general, and neither document supplies a sample large enough to say.