How to Write a Data Breach Notification Email Customers Actually Read

Most data breach notification emails fail before anyone reads the second sentence. They arrive from an address customers don’t recognize, carry a subject line that sounds like a scam, and ask people to click a link right after telling them criminals may have their data. Some land in spam. Others get deleted as phishing.

That is a marketing problem as much as a legal one. Your email team owns the sender reputation, the templates, and the sending tools, and those decide whether the notice gets read. The notice also matters long after the incident. As of October 6, 2026, TapClaim listed 19 open data breach class action settlements, and several of them start with the same eligibility test: did you receive the company’s breach notice?

Here is how to write one that customers open, believe, and act on.

Why Breach Emails Get Ignored

Customers have been trained to distrust exactly the kind of message you are about to send. Scammers copy breach notices because people react to them, so a real one has to look different on purpose.

Legitimate notices usually trip the same alarms:

• They come from a vendor’s domain or a no-reply address the customer has never seen.
• The subject line leans on urgency, such as Action required or Your account is at risk.
• The body asks people to click a link and sign in.

Fix those, and you are already ahead of most notices. Send from your own domain, write a plain subject line, and tell people where to go instead of handing them a login link.

What the Email Has to Include

Every U.S. state, plus Washington, D.C., Guam, Puerto Rico, and the U.S. Virgin Islands, has a security breach notification law, according to the National Conference of State Legislatures. The details differ by state, so counsel should approve the final text. The core content barely changes, and the FTC‘s Data Breach Response guide includes a model letter worth starting from. Cover these points in plain language:

• What happened and when, including the date you discovered it
• Which types of information were involved, and which were not
• What you have done since, such as containing the issue or contacting law enforcement
• What the customer should do now, such as freezing their credit or watching statements
• What you are offering, such as credit monitoring, with the enrollment code and deadline
• How to reach a real person, by phone and by email

Timing is set by law, not by the comms calendar. Several states, including Colorado, Florida, and Washington, require notice within 30 days, and HIPAA gives covered healthcare entities no more than 60 days from discovery. Some states accept email notice only under specific conditions, such as compliance with the federal E-SIGN Act, so check whether you also need to mail a letter.

A Data Breach Notification Email Template

Keep the subject line factual. Notice of a data security incident at [Company] works. So does [Company]: information about a security incident involving your account. Skip exclamation points, all caps, and anything that sounds like a countdown.

The body can follow this structure:

Hi [First name],

We’re writing to let you know about a security incident that involved some of your information. On [date], we discovered that [plain description, such as “an unauthorized party accessed a customer database”]. We closed off that access on [date] and are working with [outside investigators and law enforcement].

The information involved: [list]. Your [password or full card number] was not involved.

What we’re doing: [steps]. We’re also offering [24] months of free credit monitoring through [provider]. To enroll, go to [URL typed out on your own domain] and use code [code] by [date].

What you can do: [freeze your credit, review statements, change a reused password].

We will never ask for your password or payment details by email or phone. If you have questions, call [number] ([hours]) or read our FAQ at [company.com/security-incident].

[Name], [Title]

Notice what is missing: no click here, no login button, no urgency. The only URL is typed out on your own domain, and the message is signed by a named person. The we will never ask line matters too: the FTC suggests telling people how you will contact them from now on, which helps them spot the phishing that often follows a breach.

Get the Notice Into the Inbox

The best letter does nothing in a spam folder. Before the send:

1. Send from your main domain, or a subdomain customers already see in your mail, not from a breach vendor’s domain. If a vendor sends for you, authenticate it on your domain first.
2. Confirm that SPF, DKIM, and DMARC pass and align. Google has required authentication from senders of more than 5,000 messages a day to Gmail since February 2024, and Yahoo has backed the same rules.
3. Use your transactional email service, such as Postmark, Amazon SES, or SendGrid, instead of the marketing platform, and keep the notice out of promotional templates.
4. Remove link shorteners, click-tracking redirects, and images that carry the whole message. Plain text with one typed-out URL is easier for filters and people to trust.
5. Ramp the send. Start with your most engaged addresses, watch bounces and complaints, then speed up.
6. If you have BIMI set up, your verified logo appears next to the message in Gmail and Apple Mail, which helps people trust it at a glance.

After You Hit Send

The email starts the work. It doesn’t finish it.

• Publish the same notice on a page on your own domain and link to it from your homepage, so people who doubt the email can check it.
• Give support a script and a saved reply in your help desk, and staff the phone line for at least the first two weeks.
• Watch for copycats. Scammers sometimes imitate real breach notices, so warn customers about lookalike messages on the incident page.
• Keep records of who was notified, when, and through which channel.

Those records matter later, because your notification list often becomes the class list. When a breach turns into a class action, the settlement notice usually goes back to the same people. In the Globe Life and Muscatine Power and Water settlements, for example, eligibility starts with having received the company’s breach notice, and several open breach settlements offer up to $5,000 per person for documented losses. A clear, well-documented notice won’t prevent a lawsuit, but a confusing one makes everything after it harder, including the claims process.

Write It Before You Need It

The worst time to draft a breach notice is the week you need one. Write the template now, get legal to approve the structure, build the incident page as a draft in your CMS, and set up the sending domain in your transactional email service.

Then run a test. Pick a fake incident and time how long your team takes to get a reviewed notice into a test inbox. If it takes longer than a day, fix that before you need it for real.