A data breach notice is a warning, not a finished complaint. Someone else lost control of your information.
The useful next step is a dated letter to the company plus the right government form, because a notice sitting in your inbox does not create a case file. Some offices still accept mail. Many only work through a portal.
Should you send a demand letter, file with the FTC, or both?
For most U.S. consumers, start with the company and a federal report. Add a state, health, or California filing only if that office actually covers the data.
A letter is not a lawsuit
A sample letter will not pull money out of a company on its own, and it does not replace the online form a regulator actually reads. It is still worth sending.
What a complaint letter can do
A clear complaint creates a timeline the company cannot easily dismiss, and it can push them to confirm what was taken, extend monitoring, or shut down a hijacked account. Keep the story factual.
Regulators use complaints as leads. They don't work your case like a hired lawyer. They may chase a pattern across many reports, or they may do nothing with yours.
Thing is, padded legal language usually hurts. Dates, data types, and copies of the notice do more work than the word "hereby."
Collect this first
Don't start typing until the facts sit in one folder. You'll reuse every line.
- Breach notice, with the date and the data types named
- Company legal name, not just the app icon
- Your account or member ID
- Notes from support calls: date, name, what they promised
- Harm you can show: fraudulent charges, a police report number, time spent, out-of-pocket costs
If you have nothing but the notice, file anyway. The notice is evidence.
Sample complaint letter to the company
Send this to the privacy, legal, or incident address printed on the notice, and use certified mail if you are putting paper in a drop box. Email works when that is the only address they published.
Keep the tone flat and ask for specific steps. Don't invent a dollar figure you cannot back up.
[Your name]
[Your mailing address]
[Phone and email]
[Date]
[Company legal name]
[Privacy office or address on the notice]
Re: Data breach notice dated [date], account [ID]
I received your notice that my personal information was involved in a security incident. The notice says the incident occurred on or about [date] and may have included [list the data types they named: name, Social Security number, password, payment card, health information, or other items].
I hold an account with you under [email or account number]. Since the notice I have [describe facts: fraudulent charges on DATE, a new account I did not open, phishing emails that use your breach details, hours spent freezing credit].
I ask that you:
1. Confirm in writing what categories of my information were involved.
2. Tell me what you have done to secure the account.
3. Provide any monitoring or identity-protection service you are offering, including how to enroll and when it ends.
4. Tell me where to send documentation of related costs.
Copies of the notice and [any fraud letters or reports] are enclosed.
Sincerely,
[Your name]Mail a copy to yourself or BCC a personal email so you keep the sent version. If the company already opened a dedicated incident site, use that intake form too. The letter still helps if a later dispute needs a date stamp.
Where to file besides the company
Pick the office that matches the data and your state. Don't blast every agency with the same essay. Extra filings don't speed a refund.
| Office | Use it when | How it is filed |
|---|---|---|
| Federal Trade Commission | General consumer breach, fraud, identity theft | Online report, not a free-form letter |
| State attorney general | Your state or the company's state is involved | That state's consumer complaint form |
| HHS Office for Civil Rights | Medical or health-plan records under HIPAA | OCR portal, email, or mail |
| California privacy office | A business may have broken California privacy rules | CalPrivacy complaint form |
The FTC path is the one most people skip. It's also the one built for this.
File the FTC report as a form
Don't mail a paper FTC complaint letter and assume a clerk will file it, because the live intake is the online form at ReportFraud.ftc.gov. You answer what happened and what you lost.
If the breach already produced identity theft, use IdentityTheft.gov along with the fraud form. That process can build a recovery plan and letters for creditors and credit bureaus.
A report is not a lawsuit. It can still matter. Other agencies read these reports for patterns.
If you only file one federal item, file that form. Keep the confirmation number with your letter.
Health records go to HHS
Hospital, insurer, clinic, and many vendor incidents sit under the HIPAA Privacy, Security, and Breach Notification Rules. Anyone can file.
You don't have to be the patient in every situation. Stick to facts you personally know.
HHS explains the complaint process. The fastest route is usually the OCR complaint portal.
You can email completed forms to [email protected]. Unencrypted email can be intercepted. That is HHS's own warning. If that risk bothers you, use the portal or mail.
Mail goes to the U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Room 509F, HHH Bldg., Washington, DC 20201.
Turns out a lot of people send HIPAA anger to the hospital billing office and stop there. Billing can fix a bill. It doesn't open an OCR file.
California privacy complaints
California residents can file through CalPrivacy when they think a business broke a consumer privacy right. Name the business, the dates, what it did, and which right you think it violated.
Contact the business, contractor, or service provider involved first. Their page asks for that. You can describe screenshots or emails. You can choose whether to leave your contact information.
CalPrivacy is not required to act on every complaint. File anyway if the facts are solid. Keep your company letter. That contact attempt is part of the story.
If a U.K. company holds your data
U.S. forms won't cover a U.K. data protection complaint. Complain to the company first. Set out what happened, what personal data is involved, and what you want it to do.
U.K. companies should acknowledge that complaint within 30 days, starting the day after they receive it. An acknowledgement is not a full fix.
If they ignore you or the answer is poor, take it to the Information Commissioner's Office using the ICO's public complaint guidance.
When the breach becomes identity theft
A notice is not identity theft by itself. New accounts, tax refund intercepts, or medical bills you don't owe are.
Work in this order:
- Call the fraud number on any account that already moved. Ask them to freeze or close the fake activity.
- Place a fraud alert or a credit freeze with Equifax, Experian, and TransUnion.
- Create an FTC identity theft report at IdentityTheft.gov.
- Use the letters that process produces when you dispute a bureau item or a creditor's fake account.
- Change passwords on email first, then banks, then anything that shared the leaked login.
To be honest, the freeze is the step people delay because it feels permanent, like you are locking yourself out of your own credit on purpose. You can lift it when you need credit. Leaving the file open is how a thief keeps trying.
Thin complaints get ignored
Vague harm is the usual failure. "I am very concerned" tells an investigator nothing useful. "On March 4 a card I never opened appeared on my Equifax file" does.
Wrong office wastes weeks. A HIPAA portal won't process a retail password dump, and a state AG form won't enroll you in monitoring. Attach the notice.
If you mention $400 in wired "recovery" fees, include the bank screenshot. Follow up once in writing after a few weeks if a company promised a callback and vanished.
Don't wait for a class-action email before you freeze credit. Those messages, when they are real, come later. Your account can be misused in the meantime.
If you already spent an evening on hold, then another evening printing the notice, then a third trying to remember whether the email came from the retailer or the payment processor, write that sequence down anyway, because the reviewer was not on those calls and they only see the order you put on the page: dates, names, data types, then what you want done.
Keep copies. Keep the mail receipts. Keep portal confirmation numbers with the notice.
Send the company letter this week if you haven't. File the FTC report the same day. If health data was involved, add the OCR complaint. If you live in California and the issue is a privacy right, use CalPrivacy after you have contacted the business. Then watch your credit file, not your inbox, for the next move.