Topic Library — Data Breaches (Year 1 Foundations)

School: Minister Destiny Testimony Schools Track: Law Enforcement Class: Topic Library — Year 1 (Foundations) Founded and presented by: Minister Destiny Marie Morgan, Minister

A note on what this school is: this is community-designed training — Minister Destiny's program, built from lived experience in the neighborhoods being policed. It is not agency policy and does not replace your department's training, general orders, or the law. Where this program proposes new approaches, they are taught and labeled as proposals. Nothing here is legal advice.

Before you start

• This school never collects your name. Progress and quiz answers stay on your device; pass the unit quiz (80% or higher, retakes allowed) and your certificate downloads with a blank name line to fill in. Answers are not shown.
• A breach call rarely arrives labeled as one. It arrives as a panicked office manager, a school that cannot open its files, a resident holding a letter they do not understand. This unit teaches the responder's outline: what a breach is, the shapes you will meet, what the holder owes under Massachusetts law, and how your first hour protects both the investigation and the people whose information is loose — including when the breached holder is you.

The lesson

Part 1. What a data breach is — from the receiving end of the call

A data breach is an incident in which information held by an organization is accessed, acquired, used, or disclosed without authorization. Massachusetts law's working definition centers on unauthorized acquisition or use of data creating a substantial risk of identity theft or fraud — and it reaches encrypted data too, when the key was taken with it.

For the responder, three clarifications matter more than any definition. First, a breach is a crime scene that may still be in progress: the intruder may still be inside while the victim describes the ransom note to you. Second, a breach is not a system failure: computers down can be a breakdown with no information taken, and a quiet copying can leave every screen working. Your questions must separate those, because the duties that follow differ. Third, the victim in front of you is usually a holder, not the only victim: behind a breached clinic or store stand every resident whose name, birth date, and number were in the file — people whose protection clock started before anyone knew.

Part 2. The shapes you will meet — intrusion, exposure, insider, and lost media

Criminal intrusion with copying. The most consequential shape: entry through a phished password, an unpatched system, or a vendor's door — the Hackers unit's patterns — followed by quiet copying over time. Expect discovery to be old news: victims often learn from a bank or federal partners before their own systems tell them.

Ransomware with theft. Systems locked and records copied first, pressure applied with both. The Ransomware unit teaches that event in full; here, note only that its breach half carries all of this unit's notification duties.

Exposure without an intruder. A database left openly reachable, a bulk email with the wrong attachment, records mailed to the wrong person. No forced entry to investigate — but the information is equally loose, and notification duties do not ask whether a villain was involved.

Insider access and lost media. An employee opening records outside any job purpose, a stolen laptop, a missing drive. Here the "intruder" may be known and the temptation to treat it as an internal matter strong. Resist the framing: residents experience the same exposure whatever the cause.

Part 3. What the holder owes — notification duties in outline

Massachusetts chapter 93H requires, in general terms, that a person or agency holding data containing a resident's personal information notify the Attorney General and the director of consumer affairs and business regulation, and notify affected residents, as soon as practicable and without unreasonable delay, when it knows or has reason to know of a breach of security or unauthorized acquisition of that information. The regulator notice carries the detail — the nature of the incident, the number of residents affected, the kind of information involved, whether a written information security program exists, and the steps taken. The resident's letter carries the protective tools instead: the right to obtain a police report — note, in that sentence, your department — how to request a free security freeze, and the mitigation services the law provides.

Your role in this machinery is practical. Victims will ask officers whether they "have to" notify; the answer is that the duties are the holder's, the timelines are the law's, and compliance questions belong to the holder's counsel and the regulators. What you can do is document the facts the machinery runs on — when the holder learned, what it learned, what information and how many people — and direct the holder to the Attorney General's and mass.gov's reporting channels. Health holders carry an additional federal rule, read in Cases & Codes.

Part 4. The first hour — intake questions that build the file

A breach intake is an interview and a preservation exercise at once. Work these questions in order and write the answers down:

1. What was noticed, when, and by whom? Discovery facts start every clock and every timeline.
2. Is anything still happening? Systems still locked, messages still arriving, access still open — an ongoing event changes your first calls.
3. What information, and whose? Names alone, or names with Social Security numbers, account numbers, health information? How many people, and are children or protected addresses among them? Sensitivity sets urgency.
4. What has been touched since discovery? Systems wiped, machines re-imaged, logs rolled over, ransom notes deleted — well-meant cleanup is the most common destroyer of breach evidence, and your calm instruction to stop, preserve, and wait for qualified direction is often the most valuable sentence of the first hour. Your department's process and investigative partners decide who gives that direction; your job is to stop the loss meanwhile.
5. Who else has been told? Insurer, IT provider, counsel, regulators, federal channels such as ic3.gov — and, if the holder is a public agency, its own chain.

Close the intake by telling the victim plainly what happens next in your process — do not promise outcomes, timelines, or recovery of data you do not control.

Part 5. Residents, letters, and the standing question — the people behind the file

Within days of your intake, residents begin arriving holding letters they half-understand. Know the letter's logic from the Adult unit: it names the information involved and the protective steps, and omits the breach's nature by the law's own design. What a resident needs from you is translation, not investigation: verify the letter is genuine through the holder, explain freeze before monitoring — the lock before the watch — and know when the conversation becomes the Identity Theft unit's territory: an account they never opened, a tax surprise, care they never received. That is a victim report to take fully, on its own facts.

Residents also ask whether they can sue. Teach the shape, never the answer: regulators enforce the notification and security duties; private lawsuits turn first on standing — concrete harm, actually suffered by the person suing. TransUnion, read below, sorted thousands of class members by whether the harm had truly reached each of them, and breach litigation argues the same line: information taken is not automatically injury proven. Refer the legal question to lawyers, every time.

Part 6. When the breached holder is your own agency

Every department holds the same sensitive inventory the PII unit mapped: reports, queries, victim and witness information, protected addresses. When the breach is yours, the duties in Part 3 run toward your agency, and the temptations invert: delay feels protective, quiet feels loyal. Both are wrong, and both convert an incident into a credibility loss that outlasts it.

The professional sequence mirrors Part 4, pointed inward: report up the chain immediately; preserve systems and logs untouched pending qualified direction; identify what information and whose, honestly and completely; and let notification happen as the law directs, in the open. The community will judge the incident once; it will judge the handling of it for years. Departments that keep trust through a breach are the ones whose letters, when their turn came, told the truth as plainly as they expect any store or clinic to tell it.

Words to know — Data Breaches

• Breach notification — the notice a holder must give to regulators and affected people after a breach, within the law's time and content rules.
• Standing — the requirement that a person suing in federal court show a concrete, personal harm the court can remedy.
• Concrete harm — a real injury — physical, monetary, reputational, or a close relative of a traditionally recognized harm — not a bare legal violation.
• Security freeze — a free restriction on a credit file so new accounts generally cannot be opened until the person lifts it.
• Written information security program — a written plan, required of many holders, setting out the safeguards that protect personal information.
• Protected health information — health information identifying a person, held under the health-privacy rules.
• Encryption — transforming data into a form that cannot be read without a confidential process or key.
• Need-to-know access — limiting records to people whose job duties require them.
• Data minimization — collecting only the information a stated purpose needs, keeping it only as long as needed, and limiting who can touch it.

Myths vs facts — Data Breaches

• Myth: If the victim's computers still work, no breach occurred. Fact: Copying leaves systems running. A quiet theft of records can be a full breach with no visible damage.
• Myth: A holder breached through a vendor has no duties itself. Fact: Notification duties attach to whoever owns or licenses the residents' data. The vendor's failure does not move them.
• Myth: Cleanup first, questions later. Fact: Re-imaging and deletion destroy the evidence that establishes what was taken. Preservation in the first hour decides what can ever be known.
• Myth: Everyone in a breach can sue and win. Fact: Federal courts require standing — concrete harm to the person suing. TransUnion sorted a class by that line.
• Myth: If our own agency is breached, handling it quietly protects the department. Fact: The duties run toward your agency too. Delay and quiet convert an incident into a lasting credibility loss.

Think it through — Data Breaches

The situation: The manager of a home-health agency calls on a Friday afternoon: two days ago an employee opened a billing attachment that "looked wrong," yesterday staff noticed files moving oddly, and this morning a message appeared claiming records were copied and demanding payment. The agency's IT volunteer has already re-imaged two computers "to get them working again." The manager asks: "Is this a police matter, and did we do something wrong letting him clean the machines?"

Walk it through: (1) Classify the event (Part 2): this presents as intrusion with copying, now joined to extortion — a breach in progress until proven otherwise, and the health records involved raise the federal health-notification frame in Part 3. (2) Answer the cleanup question honestly (Part 4, question 4): the re-imaging likely destroyed evidence on those two machines — say so plainly, and give the instruction that matters now: nothing else is wiped or deleted; everything is preserved pending qualified direction. (3) Run the rest of the intake in order (Part 4): discovery facts, whether access is still open, what information and how many patients — children or protected addresses among them — and who has been told so far. (4) Set the holder's duties in motion without deciding them (Part 3): notice obligations are the agency's and its counsel's, on the law's timeline; document the facts those notices will run on, and point the manager to the Attorney General's and mass.gov's reporting channels and ic3.gov. (5) Close with what you will not promise: not recovery, not attribution, not a timeline — only the next step in your process.

Cases & codes to study — Data Breaches

TransUnion LLC v. Ramirez, 594 U.S. 413 (U.S. Supreme Court, 2021)

• The facts: A credit reporting agency's screening product wrongly flagged thousands of people as potential matches to a government watch list, based on name alone. One man learned of it when a car dealership refused to sell to him. A class of 8,185 people sued; for 1,853 of them the misleading report had been sent to a business; for the rest it had never left the agency's files.
• The question: Which class members, if any, suffered a concrete harm giving them standing to sue in federal court for the agency's violations of the credit-reporting law?
• The ruling and the outcome: The Supreme Court reversed the court of appeals in part: the 1,853 whose reports were disseminated had standing, because their reputational harm resembled a traditionally recognized injury; the rest — and everyone but the named plaintiff on the mailing-format claims — had not shown concrete harm. The judgment was reversed and the case sent back.
• Why it matters to you: Residents will ask whether a breach means a winning lawsuit. This case is the honest shape of the answer: standing is sorted person by person, on actual harm — and that question belongs to lawyers, not the desk (Part 5).
• 📄 Court document: https://supreme.justia.com/cases/federal/us/594/20-297/ (the full opinion, reproduced at the Justia U.S. Supreme Court Center)

The law itself — read the real words

• Mass. Gen. Laws ch. 93H, § 3 (Mass. Gen. Laws) — requires notice, as soon as practicable and without unreasonable delay, to the Attorney General, the consumer-affairs director, and affected residents when a breach of security or unauthorized acquisition of personal information is known. Read it: https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter93H/Section3
• 45 C.F.R. §§ 164.400–414 (Code of Federal Regulations) — the HIPAA breach notification rules: when health holders must notify affected individuals and the Secretary of Health and Human Services after a breach of unsecured protected health information. Read it: https://www.ecfr.gov/api/renderer/v1/content/enhanced/2024-04-10/title-45?subtitle=A&subchapter=C&part=164
• 16 C.F.R. Part 314 (Code of Federal Regulations) — the FTC Safeguards Rule: standards requiring financial institutions under the FTC's jurisdiction to maintain a written information security program protecting customer information. Read it: https://www.ecfr.gov/api/renderer/v1/content/enhanced/2024-03-26/title-16?chapter=I&subchapter=C&part=314

Where to read the real thing, free: CourtListener (https://www.courtlistener.com) for court opinions; Massachusetts law at malegislature.gov (https://malegislature.gov); federal regulations at ecfr.gov (https://www.ecfr.gov).

Try this — Data Breaches

• ☐ Memorize the five first-hour intake questions in Part 4, in order.
• ☐ Locate your department's breach and digital-evidence process and the partners it routes to — before a live call, not during one.
• ☐ Practice the resident explanation: freeze before monitoring, in two plain sentences.
• ☐ Walk your own station's PII storage with Part 6 in mind: what would your agency's letter have to say?

Resources to keep — Data Breaches

• 911 — for immediate danger to any person.
• FBI Internet Crime Complaint Center — ic3.gov — the federal reporting channel for intrusions.
• mass.gov — Massachusetts breach-reporting information.
• HHS OCR: 1-800-368-1019 — for health-information breach questions.
• Free Pathways Guide — this school's guide to turning free study into real credentials (in the Topic Library).
• 988 (call or text) — support any time an incident becomes a crisis.

What you earned / what's next — Data Breaches

✅ Data Breaches complete (quiz score 80% or higher): You can define a breach from the responder's side, recognize its four shapes, state the holder's Massachusetts notification duties, run the five-question first-hour intake, translate a breach letter for a resident, and describe your agency's duties when the breach is its own.

Your certificate

Minister Destiny Testimony Schools Certificate of Completion — Data Breaches

This certificate is presented by Minister Destiny Marie Morgan, Minister

Awarded to: ______________________________ (write your name here after you download — your name is never collected or stored by this school)

Date completed: ______________

Congratulations. In the first hour of a breach, calm questions and untouched evidence are worth more than speed. You know the questions, and what not to promise. — Minister Destiny Marie Morgan

This is a certificate of educational completion from Minister Destiny Testimony Schools. It is not a state license, a government certification, or legal training for representing anyone. School rank and completion are school achievements only — not a law-enforcement rank, title, or credential.

What's next: Return to the Topic Library for your next Year 1 unit.

Sources

• CS406: Information Security — Saylor Academy (https://learn.saylor.org/mod/page/view.php?id=29839) — open courseware checked for security and privacy-law coverage.
• Foundations of Information Systems, Chapter 6 — OpenStax (https://openstax.org/books/foundations-information-systems/pages/6-summary) — open textbook checked for breach and privacy concepts.
• Report a data breach — Mass.gov (https://www.mass.gov/info-details/report-a-data-breach) — Massachusetts summary of the notification law.
• TransUnion LLC v. Ramirez, 594 U.S. 413 (U.S. Supreme Court 2021) — standing turns on concrete harm; who in a class was actually harmed.
• Chapter 93H § 3 (Mass. Gen. Laws) — the Massachusetts duty to report a known security breach.
• Part 164, §§ 164.400–414 (Code of Federal Regulations) — HIPAA breach notification duties for unsecured health information.
• Part 314 (Code of Federal Regulations) — the FTC Safeguards Rule: written information security program standards.

Course Record — Data Breaches

• Learning outcomes: On completing this unit, the student can:
• define a data breach and distinguish it from a system failure;
• describe the four breach shapes a responder is likely to meet;
• state the holder's Massachusetts notification duties and what a resident's letter must contain;
• conduct a first-hour breach intake using the five questions in order, with preservation of evidence;
• explain a breach letter and the freeze-before-monitoring guidance to a resident;
• describe an agency's duties when the breached holder is the agency itself.
• Study time: Approximately 1 hour — covering reading, activities, and the test. Students move at their own pace.
• Assessment: A 10-question test drawn only from this unit's lesson. 80% or higher passes and earns the unit certificate. Answers are not shown; your score is saved to your student record, and retakes are allowed.
• Level: Topic Library — Year 1 (Foundations) · Law Enforcement school · working rank on completion path: Freshman → Sophomore.
• Version: Version 1.0 — October 2026.

Minister Destiny Testimony Schools — Law Enforcement. Educational information only, not legal advice. Help lines: 911 for emergencies · 988 Suicide & Crisis Lifeline (call/text 988).