Why a breach letter arrives months after the incident: notification timing in AG filings

What the question asks

Breach letters often reach people long after the incident. This guide uses two notices filed with the California Attorney General and the Attorney General's reporting page. It sets out the dates each document gives for discovery, the letter and the filing. It also records the reasons each company gives for the gap. The documents do not state a general rule for how long companies take, so this guide covers only these two cases.

What the California reporting page says

The California Attorney General's page says California law requires a business or state agency to notify any California resident whose unencrypted personal information was acquired, or reasonably believed to have been acquired, by an unauthorized person.

The page also describes a separate duty to the Attorney General. A business that must notify more than 500 California residents because of a single breach must electronically submit one sample copy of the notification, without personally identifiable information, to the Attorney General.

The page, as provided, carries no date and gives no deadline in days. It therefore does not say how soon after discovery a letter must go out. It also does not say how soon after the letter a sample must be filed.

Case one: Inner City Education Foundation

The Inner City Education Foundation (ICEF) letter is dated October 16, 2026. The filing is logged with the same date, October 16, 2026.

The letter says ICEF became aware of suspicious activity on its network on September 30, 2024. That is about two years before the letter date.

The letter says the investigation found that an unauthorized actor gained access to certain ICEF systems between August 4 and September 29, 2024, and may have taken certain information.

The letter gives one reason for the interval: ICEF says it conducted "a comprehensive and time-intensive review to determine what information was involved and to whom such information relates." The letter does not say how long that review took. It also does not say when the review finished, beyond saying the process was completed and notices are being provided.

The letter states that the notice was not delayed by law enforcement. On the letter's own account, the delay came from the review of the data.

Case two: Lexitas

The Lexitas letter carries the date October 14, 2026. The Attorney General filing is dated October 22, 2026, eight days after the letter date. The document is marked as a draft proof with test data, so it is a template and not a letter to a real recipient.

The letter says Lexitas learned on May 29, 2026, from a customer, that a web server configuration error had made certain files in its OnDemand (DepositionNet) application accessible over the internet without authentication. From that discovery date to the letter date is about four and a half months.

The letter also says the investigation determined that the configuration error occurred in or around September 2019 and was not detected at the time. The exposure window therefore began years before discovery. That is a separate gap from the one between discovery and notice.

Lexitas gives its reason for the time between discovery and the letter. It says personal information in the documents is scattered through written testimony instead of sitting in a searchable database. It says identifying affected individuals required extensive manual review that took several months.

The letter says Lexitas restricted access to the affected server within hours. It also states that the notice was not delayed because of a law enforcement investigation.

The Rhode Island section says approximately 14,361 individuals nationwide were affected.

Three dates in each filing

The documents give these dates:

• ICEF: suspicious activity September 30, 2024; letter October 16, 2026; filing October 16, 2026.
• Lexitas: discovery May 29, 2026; letter October 14, 2026; filing October 22, 2026.

In both cases the letters say the main reason for the wait was the work of identifying who was affected and what data was involved. Neither letter says the wait came from a law enforcement hold. Each states that law enforcement did not delay the notice.

What the letters do not say

Neither letter cites a legal deadline or says whether the company met one. Neither explains why it took the time it did beyond the review described above. ICEF does not give the length of its review. Lexitas says only "several months."

Each letter pairs notice with a time-limited offer. Both letters say recipients must enroll in the credit monitoring offered through Cyberscout within 90 days from the date of the letter. ICEF's letter offers 12 months of monitoring. The Lexitas letter says the services are available for at least twelve months to California residents. The 90-day enrollment window runs from the letter date, not from the incident or the discovery date.

How to read a filing date

An Attorney General record shows the date of the letter and the date it was filed. The incident and discovery dates appear only in the letter text. A reader of the record has to compare these dates by hand. In the two cases above, the letter date and filing date were the same day for ICEF and eight days apart for Lexitas. The larger gaps sit earlier in the timeline, between the incident or discovery and the letter.