Sample SaaS Data Breach Demand Letters
Sample 1: CCPA Section 1798.150 Pre-Suit Notice
[Your Name]
[Your Address]
[City, CA ZIP]
[Email] | [Phone]
[Date]
VIA CERTIFIED MAIL - RETURN RECEIPT REQUESTED
[SaaS Company Name]
Legal Department
[Address]
[City, State ZIP]
Re: NOTICE OF VIOLATION OF CALIFORNIA CIVIL CODE SECTION 1798.150
30-Day Cure Period Under CCPA
Data Breach Affecting [Your Name]
Dear [Company]:
This letter constitutes formal notice under California Civil Code Section 1798.150(b) that you have violated the California Consumer Privacy Act of 2018 (CCPA).
FACTS:
On or about [Date], your company suffered a data breach that resulted in the unauthorized access and acquisition of my personal information. You notified me of this breach on [Date], approximately [X] days/weeks after the breach occurred.
According to your notification, the following categories of my personal information were compromised:
- [Social Security number]
- [Financial account information]
- [Driver's license number]
- [Login credentials]
- [Other data types]
VIOLATIONS:
You violated California Civil Code Section 1798.150(a)(1) by failing to implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information to protect that information from unauthorized access, destruction, use, modification, or disclosure.
Evidence of your inadequate security practices includes:
1. [Describe known security failures - e.g., "The breach resulted from unencrypted database storage of personal information"]
2. [E.g., "Your company failed to implement multi-factor authentication"]
3. [E.g., "Delayed detection suggests inadequate security monitoring"]
As a result of your failure to implement reasonable security, my nonencrypted and nonredacted personal information, as defined in California Civil Code Section 1798.81.5, was subject to unauthorized access and exfiltration.
DAMAGES:
Under Section 1798.150(a)(1)(A), I am entitled to recover statutory damages of not less than one hundred dollars ($100) and not greater than seven hundred and fifty dollars ($750) per consumer per incident, OR actual damages, whichever is greater.
My actual damages include:
1. Out-of-Pocket Expenses:
- Credit monitoring services: $[amount]
- Credit freeze fees: $[amount]
- Time and correspondence: $[amount]
TOTAL: $[amount]
2. Time Spent Addressing Breach:
- [X] hours at $[rate]/hour: $[amount]
3. Increased Risk:
- My [Social Security number/financial information] is permanently compromised
- I face years of heightened vulnerability to identity theft
4. Emotional Distress:
- Significant anxiety and stress regarding financial security
TOTAL DAMAGES CLAIMED: $[amount] (or statutory minimum of $750, whichever is greater)
30-DAY CURE PERIOD:
Pursuant to California Civil Code Section 1798.150(b), you have thirty (30) days from receipt of this notice to cure the alleged violation of Section 1798.150. An adequate cure must include:
1. Reimbursement of all out-of-pocket expenses: $[amount]
2. Compensation for time spent: $[amount]
3. 24 months of comprehensive credit monitoring from all three bureaus (Experian, Equifax, TransUnion)
4. Identity theft insurance policy of at least $1,000,000
5. Identity restoration services if needed
6. Written confirmation of enhanced security measures implemented
If you do not cure the violation within 30 days, I will pursue all available legal remedies, including but not limited to:
- Filing a lawsuit seeking statutory damages of $750 per incident
- Actual damages in excess of statutory amounts
- Injunctive relief
- Attorney fees and costs
I also reserve the right to participate in any class action filed against your company regarding this breach and to file complaints with the California Attorney General and Federal Trade Commission.
This letter constitutes formal notice under CCPA Section 1798.150(b). The 30-day cure period begins upon your receipt of this letter.
Sincerely,
_______________________
[Your Signature]
[Your Printed Name]
Enclosures:
- Your breach notification letter dated [Date]
- Documentation of expenses incurred
- Time log
Sample 2: Comprehensive Demand (Negligence + Contract + CCPA)
[Your Name]
[Your Address]
[City, CA ZIP]
[Email] | [Phone]
[Date]
VIA CERTIFIED MAIL - RETURN RECEIPT REQUESTED
[SaaS Company Name]
Attn: Legal Department / Data Privacy Officer
[Address]
[City, State ZIP]
Re: DEMAND FOR COMPENSATION - DATA BREACH
Account: [Your Account Number/Email]
Breach Notification Date: [Date]
Dear [Company]:
I am writing to demand compensation for the data breach you disclosed on [Date], which compromised my personal information due to your inadequate security practices and failure to protect customer data as required by California law and your own contractual commitments.
BACKGROUND:
I have been a customer of [Company Name] since [Date], using your [product/service name] for [purpose]. On [Notification Date], I received notice that my account data had been compromised in a security breach affecting [number if known] customers.
According to your notification and public reports, the breach resulted from [describe known cause - e.g., "a misconfigured cloud database," "an unpatched vulnerability," "a phishing attack on employee credentials," etc.].
COMPROMISED DATA:
Your notification indicates the following personal information was exposed:
- Name and email address
- [Social Security number]
- [Financial account/credit card information]
- [Driver's license number]
- [Login credentials]
- [Other exposed data]
LEGAL VIOLATIONS:
Your conduct violated multiple California laws:
1. CCPA Section 1798.150 - Security Failure
You failed to implement and maintain reasonable security procedures appropriate to the nature of the personal information you collected. This failure directly resulted in the unauthorized access to my nonencrypted personal information.
2. California Civil Code Sections 1798.82/1798.29 - Notification Violations
[If applicable: Your notification was delayed by [X] weeks/months after the breach was discovered, violating the requirement to notify "without unreasonable delay."]
[If applicable: Your notification failed to include required content under Section 1798.82(d), specifically [missing elements].]
3. Negligence
You owed a duty of care to implement reasonable security measures to protect my personal information. You breached this duty by [specific failures]. This breach proximately caused my damages.
4. Breach of Contract
Your [Terms of Service/Privacy Policy] promised [quote relevant security commitments - e.g., "industry-standard security measures," "encryption of personal data," etc.]. You breached these commitments.
5. Breach of Implied Contract
By accepting my personal information, you impliedly agreed to protect it using reasonable security measures.
MY DAMAGES:
As a direct result of your breach, I have suffered the following damages:
1. Out-of-Pocket Expenses:
- Credit monitoring service (self-purchased): $[amount]
- Credit freeze fees: $[amount]
- Time and postage: $[amount]
- [Other expenses]: $[amount]
SUBTOTAL: $[amount]
2. Time Spent:
- [X] hours monitoring accounts, freezing credit, disputing charges, corresponding with you
- Valued at $[rate]/hour: $[amount]
3. Fraudulent Activity (if applicable):
- [Describe any unauthorized charges, accounts opened, etc.]
- Amount: $[amount]
4. Emotional Distress:
- Significant anxiety about identity theft
- Disruption of daily life monitoring accounts
- Ongoing stress regarding permanent exposure of SSN
5. Increased Future Risk:
- My Social Security number is now permanently compromised
- Requires lifetime vigilance and monitoring
TOTAL DOCUMENTED DAMAGES: $[amount]
CCPA STATUTORY DAMAGES (if actual lower): $750
DEMAND:
I demand the following within thirty (30) days of your receipt of this letter:
1. Monetary Compensation:
- Reimbursement of out-of-pocket expenses: $[amount]
- Compensation for time spent at $[rate]/hour: $[amount]
- Additional compensation for distress and risk: $[amount]
- OR CCPA statutory damages of $750 (whichever is greater)
2. Credit Protection:
- 24 months of comprehensive credit monitoring from ALL three bureaus
- Identity theft insurance of at least $1,000,000
- Full identity restoration services if needed
3. Service Credits:
- Refund of subscription fees for period during which data was compromised: $[amount]
4. Information:
- Complete disclosure of all categories of my data that were accessed
- Confirmation of enhanced security measures implemented
CONSEQUENCES OF NON-COMPLIANCE:
If you fail to provide adequate resolution within 30 days, I will:
1. File a lawsuit in California Superior Court seeking statutory damages, actual damages, punitive damages for willful conduct, and attorney fees
2. Participate in or initiate class action litigation
3. File complaints with:
- California Attorney General, Privacy Enforcement Section
- Federal Trade Commission
- [Relevant industry regulators]
This letter constitutes the 30-day notice required under CCPA Section 1798.150(b). All rights and remedies are expressly reserved.
I am willing to discuss reasonable resolution. Please contact me at [Email/Phone].
Sincerely,
_______________________
[Your Signature]
[Your Printed Name]
Enclosures:
- Your breach notification
- Documentation of damages
- Time log
- Screenshots of account activity
- [Other supporting documents]
Sample 3: Follow-Up After Inadequate Response
[Your Name]
[Your Address]
[City, CA ZIP]
[Date]
VIA CERTIFIED MAIL - RETURN RECEIPT REQUESTED
[SaaS Company Name]
Legal Department
[Address]
Re: FOLLOW-UP DEMAND - INADEQUATE RESPONSE TO DATA BREACH CLAIM
Original Demand Letter: [Date]
Your Response: [Date]
Dear [Company]:
This letter responds to your [Date] communication regarding my demand letter of [Original Date] concerning the data breach affecting my personal information.
INADEQUATE RESPONSE:
Your response is inadequate for the following reasons:
1. Credit Monitoring Offer Insufficient:
You offered 12 months of single-bureau monitoring. Given that my [Social Security number/financial information] was exposed, this is woefully inadequate. I demanded, and continue to demand, 24 months of three-bureau monitoring with identity theft insurance.
2. No Compensation for Damages:
You failed to address my documented out-of-pocket expenses of $[amount] and time spent ([X] hours) addressing this breach. These are direct, provable damages caused by your security failure.
3. Failure to Address Security Violations:
You have not acknowledged the security failures that led to this breach or confirmed what measures have been implemented to prevent recurrence.
4. [Other inadequate aspects of response]
30-DAY CURE PERIOD STATUS:
My original letter dated [Date] constituted notice under CCPA Section 1798.150(b). The 30-day cure period [has expired / expires on [Date]].
[If expired:] As you have failed to cure the violations within 30 days, I am now entitled to pursue litigation for statutory damages of up to $750 per incident plus actual damages and attorney fees.
[If not expired:] You have until [Date] to provide an adequate cure as specified in my original demand.
FINAL DEMAND:
I will accept resolution of this matter if you provide the following within [10/14] days:
1. 24 months of three-bureau credit monitoring with $1M identity theft insurance
2. Reimbursement of documented expenses: $[amount]
3. Compensation for time at $[rate]/hour ([X] hours): $[amount]
4. [Additional demands]
TOTAL: $[amount] plus credit monitoring/insurance
LITIGATION NOTICE:
If I do not receive acceptable resolution by [Deadline Date], I will immediately:
1. File a complaint in California [Small Claims Court if under $12,500 / Superior Court] seeking statutory damages, actual damages, and all available remedies
2. Retain counsel to pursue class action participation or individual litigation for attorney fees
3. Report your inadequate response to the California Attorney General
This is my final demand. There will be no further extensions.
Sincerely,
_______________________
[Your Signature]
[Your Printed Name]
cc: California Attorney General [optional]