Data Breach Notice Decoder
Got a letter saying your personal information was involved in a data breach? Paste its text and get a plain-English breakdown: what data was exposed, when it happened and was discovered, the credit monitoring on offer and its enrolment deadline, the phone numbers and links to check before you use them, and the questions the letter leaves open. It runs entirely in your browser with fixed rules, no AI: the text never leaves your device. For a recent example, read our breakdown of the Vanguard data breach notice.
Companies also file these notices with state attorneys general. The Vermont Attorney General's list shows the reporting organisation, the number of Vermont residents affected and the categories of data breached. It no longer posts the PDF notices; you can request a copy of a sample consumer notice by emailing AGO.SecurityBreach@vermont.gov. The California Attorney General's list publishes sample notices sent to more than 500 California residents.
1. Paste the letter
Copy the text from the letter or the PDF and paste it here. The decoder runs in your browser: the text never leaves it, is not sent to us and is not saved. The sample is a fictional letter from a made-up company.
TL;DRWhat this decoder does
5 points
- Paste the text of a data breach notification letter, the kind US companies mail to people and file with state attorneys general.
- The decoder lists the data the letter says was involved (Social Security numbers, government ID, financial accounts, payment cards, health, biometric, genetic, date of birth, logins, email) and what it says was not.
- It pulls out the incident window, discovery date, letter date and the deadline to enrol in credit monitoring with the days left, plus the monitoring length, provider and whether an enrolment code is present (masked).
- It flags vendor, ransomware, unauthorised access and law enforcement wording, lists every phone number and web address so you can check them yourself, rates the risk, and lists the questions the letter does not answer.
- Rule-based, no AI: the text never leaves your browser and is not saved. Using it is free, signed out too; copying and downloading the breakdown are available with a paid plan.
Frequently asked questions
What does a data breach notice letter mean?
It means a company believes someone without permission accessed or took personal information it held about you, and a state law requires it to tell you. Most US letters follow the same layout: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. The section that matters most is the list of data involved: a Social Security number, government ID, financial account with access codes, or health data carries more risk than an email address.
Is a data breach letter a scam?
Most are genuine, but scammers copy the format. Warning signs are pressure to act within hours, a request to confirm your full Social Security number, bank details or a password, payment for "protection", or a phone number or website you cannot match to the company. A genuine letter tells you what happened and offers steps; it does not ask you to send it sensitive data.
How do I know if a breach letter is real?
Do not use the phone number or link in the letter to check it. Find the company's contact details yourself, from its website typed into your browser, a statement or a card, and ask whether it sent the notice. You can also look for the company on a state attorney general's breach list: California publishes sample notices sent to more than 500 California residents, and Vermont lists the reporting organisation, the number of Vermont residents and the categories of data.
What should I do if my Social Security number was in a data breach?
Freeze your credit at Equifax, Experian and TransUnion (a freeze is free under US federal law), enrol in any monitoring the company offers before its deadline, consider an IRS Identity Protection PIN, and check your credit reports at annualcreditreport.com. Our SSN Exposure Action Plan walks through it step by step.
Should I sign up for the credit monitoring offered in a breach letter?
It is usually worth enrolling, but only through a website or number you have checked against the company's own site, and before the enrolment deadline in the letter. Monitoring tells you after something happens; a credit freeze stops most new credit being opened in your name, so do both.
Where can I see breach notices companies filed with state attorneys general?
Several states publish lists. The California Attorney General lists sample notices sent to more than 500 California residents, with the breach dates. The Vermont Attorney General lists, from April 17, 2026, the reporting organisation, the number of Vermont residents affected and the categories of data; it no longer posts the PDF notices, but you can request a copy of a sample consumer notice by email at AGO.SecurityBreach@vermont.gov.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.