Notification Lag: Why Your Stolen Credentials Go on Sale Months Before the Letter Arrives

A breach notification letter is, by design, a message about the past. It describes an intrusion that has already occurred, records that have already left a server, and a window of exposure that has already closed — or, occasionally, has not. For most Americans, that letter is the first and only signal that a Social Security number, home address, or password vault was swept up in somebody else's security failure. It is also, almost without exception, the last piece of information to arrive.

The lag is not an accident. It is the predictable output of an ecosystem in which the breached organization controls the timeline, fifty state legislatures set wildly different rules, and criminal marketplaces operate in hours rather than quarters. The practical conclusion is uncomfortable but clarifying: by the time you are notified, you should assume the damage has already been priced, packaged, and sold.

The Letter Is the Last Domino to Fall

Between the moment an attacker gains access and the moment a notice lands in your mailbox, an entire chain of events must play out. The company has to notice the anomaly — often weeks or months after the fact, and frequently only because a third party tells them. It has to retain outside forensics, determine scope, and identify which records belong to which individuals. Counsel weighs legal exposure. Insurers review language. Law enforcement may ask for silence during an active investigation. Only then does the mailing vendor get the file.

Each step is defensible on its own. Stacked together, they produce a gap measured in months, during which credentials are live and the account holder is uninformed. The individual who could have changed a password in week one is instead reading about it in week fourteen.

Fifty States, Fifty Clocks

There is no federal breach notification statute covering the private sector. Every state has one, but the details diverge in ways that matter. Some statutes trigger on a name combined with a Social Security number or financial account; others are narrower. Deadlines range from a firm 30 days to the deliberately elastic phrase 'without unreasonable delay,' which invites a company to conclude that its own delay was reasonable. Several states require notice to the attorney general as well as to consumers; others do not.

A national retailer, hospital system, or payroll processor typically resolves this complexity by meeting the slowest applicable standard. Compounding the problem, many statutes allow an organization to skip notification entirely if it determines internally that the incident presents no reasonable risk of harm. No regulator pre-approves that judgment. It is made by the party with the strongest incentive to reach it.

What Actually Circulates After a Breach

The stolen data rarely stays in its original form. Bulk records are parsed, deduplicated, and repackaged as credential lists sold in batches. More damaging still is what infostealer malware produces: logs harvested directly from infected machines, containing saved passwords, autofill entries, and live session cookies. A session cookie can let an attacker walk past a password prompt without ever knowing the password, and in some configurations can blunt the protection of multi-factor authentication altogether.

That material moves quickly. Credentials are tested against banking portals and email providers within days. Access is sold to intermediaries who resell to specialists. The first fraud attempts frequently precede the victim company's public disclosure by a wide margin — which is why an unexplained login alert on a Tuesday can turn out to be the opening chapter of a breach story you will read about in the spring.

A Containment Plan You Can Start This Weekend

If the data is already out there, prevention alone is insufficient. The goal becomes containment: limiting what a criminal can do with information they already hold.

Freeze your credit, at all three bureaus. Equifax, Experian, and TransUnion all offer freezes at no cost under federal law, and thawing is free as well. A freeze blocks most new-account fraud, which is the single most expensive consequence of an identity data breach. It is a stronger control than a paid credit lock, and it takes roughly twenty minutes to complete.

Layer your alerts. Register with a breach notification service so you learn about exposures from sources other than the breached party. Set transaction and login alerts on every financial account, and turn on new-account notifications with your bank and cards.

Harden the accounts that reset everything else. Your primary email address and your mobile carrier account are the master keys. Use a unique password and a passkey or authenticator app on email, and ask your carrier for a port-out PIN or SIM lock. Number porting is the fastest route to bypassing SMS-based verification.

Retire reused passwords. A password manager makes unique credentials practical; passkeys, where offered, remove the credential from the equation entirely. Prioritize email, banking, tax preparation, and any account with a stored payment method.

Request an IRS Identity Protection PIN. The agency's program issues a fresh six-digit PIN each filing season, which blocks a fraudulent return filed in your name.

Expect the second wave. Breach lists are recycled into phishing campaigns that cite the very incident you just read about, complete with convincing branding. Treat any inbound message about the breach — even one that looks official — as hostile until you have verified it through a channel you initiated.

The Mindset That Actually Works

Waiting for a letter is a strategy that assumes someone else is managing your risk. They are not; they are managing their own. The realistic posture is to treat your personal information as already compromised and to invest in the controls that still function after that assumption: freezes, unique credentials, hardened recovery paths, and monitoring that tells you when something changes.

This is where products such as Norton 360 with LifeLock earn their place in a household budget. Dark web monitoring surfaces credential appearances early, identity restoration specialists handle the paperwork if fraud occurs, and built-in VPN protection reduces exposure on public networks where session hijacking is common. None of it replaces a credit freeze. Together, they shorten the window between exposure and response — which is the only variable an individual truly controls.

The letter, when it comes, is a formality. The work happens before it.