Washington educational resource

Washington data breach turned into actual identity theft? Demand letter strategy when the injury is real

An individual Washington data breach claim is hard to monetize when the breach is recent and no fraud has happened yet. The matter changes when the breach has matured: when a fraudulent account is opened in your name, when an unauthorized transfer hits a financial account, when a tax return is filed by someone else, when a medical bill arrives for services you did not receive. That is "injury to property" in the Consumer Protection Act sense, and it converts a thin notice-based theory into a real demand letter. Chapter 19.255 RCW supplies the breach-notification framework and the consumer protection section at RCW 19.255.040, which gives the Attorney General CPA-style enforcement authority and separately lets an injured consumer bring a civil action for damages and injunctive relief. The statute itself says, however, that an action to enforce Chapter 19.255 may not be brought under RCW 19.86.090, so the full Chapter 19.86 remedy stack (treble damages, one-way attorney fees) does not automatically attach. A separate Chapter 19.86 CPA claim may still be available when the facts independently satisfy the CPA elements. The honest answer about scope: even with documented identity theft, a single consumer letter usually gets a settlement in the low four figures plus extended identity-theft monitoring, not a windfall. The point of the letter is to recover real out-of-pocket loss, preserve the limitations period, and document the matter for any later class case.

Last legally reviewed: 2026-05-19. Statute text retrieved from Chapter 19.255 RCW and Chapter 19.86 RCW on app.leg.wa.gov on that date. A Washington-admitted attorney should confirm current text and any controlling case law before relying on a specific subsection in a live matter.

Fast triage: is this an identity-theft-strengthened breach claim?

• Was your personal information part of a documented Washington breach (the company's notice, the Washington AG breach archive, or an FTC entry)?
• Did identity theft actually happen after the breach: new account fraud, account takeover, tax-return fraud, medical-identity theft, synthetic-identity fraud, or unemployment-benefit fraud in your name?
• Do you have documentary proof of the fraud: a credit report showing accounts you did not open, a bank or card statement showing unauthorized activity, an IRS notice, a medical bill, or a state unemployment denial?
• Did you incur out-of-pocket loss to mitigate: identity-theft monitoring you paid for, credit-freeze fees, fees to obtain a credit report, fees for a lawyer to send a removal demand, or unreimbursed loss after the financial institution applied its zero-liability policy?
• Are you a Washington resident? Ch. 19.255 protects Washington residents specifically.

If you answer yes to one, two, three, and most of four, you have the bones of an identity-theft-strengthened CPA matter. The strength of the demand letter is roughly proportional to your documented mitigation cost plus your unreimbursed loss.

The legal hooks: how a breach-plus-theft matter is framed

The path through Ch. 19.255 is more nuanced than a clean per se CPA hook. RCW 19.255.010 imposes the breach-notification obligations and defines personal information broadly enough to cover SSN, driver's license, account numbers with security codes, biometric data, and login credentials. RCW 19.255.040 is the consumer protection section: it gives the Attorney General CPA-style enforcement authority under the public-interest and unfair-or-deceptive framework, and it separately lets an injured consumer bring a civil action for damages and injunctive relief. The statute itself says, however, that an action to enforce Chapter 19.255 may not be brought under RCW 19.86.090, so I do not assume the full RCW 19.86.090 private CPA remedy stack (treble damages capped at twenty-five thousand dollars per RCW 19.86.020 violation, one-way attorney's fees) automatically applies to a breach-notification claim. A separate Chapter 19.86 CPA claim may still be available when the facts independently satisfy the CPA elements: RCW 19.86.020 prohibits unfair or deceptive acts in trade or commerce, RCW 19.86.093 codifies the public-interest paths, and RCW 19.86.090 supplies the remedy for that independent CPA claim. RCW 19.86.120 is the four-year statute of limitations from accrual for the independent CPA frame.

The negligence frame is a separate path. A company that exposed your personal information through inadequate security can also face common-law negligence and contract claims independent of Ch. 19.255. Those claims have their own elements (duty, breach, causation, damages) and a different limitations analysis. Many demand letters combine the Chapter 19.255 consumer civil action under RCW 19.255.040 with an independently pleaded Chapter 19.86 CPA theory and a negligence theory, because the layered approach addresses the statutory limit on RCW 19.86.090 routing while still preserving fee-shifting on the freestanding CPA claim where the facts support it. Negligence is useful as a parallel theory and a reason the case is worth more than the limited Chapter 19.255 frame might suggest.

Quantifying identity-theft injury under the CPA

The CPA reaches "injury to business or property," not personal injury or pure emotional distress. The categories that have been recognized as CPA injury in identity-theft contexts generally include:

• Out-of-pocket loss not reimbursed by the financial institution after zero-liability policies are applied.
• Identity-theft monitoring services you bought to mitigate post-breach risk.
• Credit-freeze fees and fees to obtain credit reports.
• Costs to obtain notarized affidavits, certified mailings, and police reports to dispute fraudulent accounts.
• Costs to remediate medical-identity theft: corrected medical records, billing-dispute fees, lost time off work.
• Time spent on the matter, valued at a reasonable hourly rate if you can document it (the value is contestable but recoverable in some matters).

Pure anxiety and emotional distress are not CPA injuries. A purely speculative theory ("I worry my data is out there") does not satisfy element four. The demand letter is built around the documented dollar numbers, not around the speculative worry.

Documents to gather before the letter goes out

• The breach notice you received from the company, with date.
• Annual credit reports from Experian, Equifax, and TransAnion showing the fraudulent accounts, with date pulled.
• Police report and the FTC IdentityTheft.gov report (the FTC version is what most creditors require to dispute).
• Bank, card, and payment-app statements showing unauthorized activity with dispute outcomes.
• IRS Form 14039 if a fraudulent tax return was filed.
• Medical bills, EOBs, and provider records showing fraudulent medical services.
• State unemployment-benefit denial or fraud notice if applicable.
• Receipts for monitoring services, credit-freeze fees, certified-mail postage, and notarized affidavits.
• A short timeline: breach date per the notice, first fraud event, mitigation steps, current status.

What a Washington identity-theft demand letter should do

• Identifies the breach by date, scope, and personal-information categories, with citation to the company's own notice and the AG breach archive.
• Identifies the documented identity theft with specifics: account numbers, fraud dates, dispute outcomes, mitigation costs.
• Cites the consumer protection section at RCW 19.255.040 for the AG enforcement framework and the consumer civil action for damages and injunctive relief, and pleads an independent Chapter 19.86 CPA claim with RCW 19.86.090 remedies only where the facts satisfy the CPA elements on their own; the letter does not assume trebling or fee-shifting auto-routes from Chapter 19.255.
• Quantifies injury with arithmetic: unreimbursed loss, monitoring fees, freeze fees, time records, and any other documented out-of-pocket.
• Demands a specific outcome: refund of mitigation costs, extended identity-theft monitoring of a defined duration, payment for documented unreimbursed loss, and a written commitment to preserve breach-related records.
• Preserves applicable limitations periods by documenting transmission (certified mail with return receipt plus email to the company's privacy or compliance contact); the four-year CPA SOL applies to an independent Chapter 19.86 claim where pleaded.
• Reserves rights to participate in any class case, to refer the matter to the Washington Attorney General or the FTC, and to amend if additional fraud surfaces.

When this is worth hiring an attorney

An attorney-drafted letter usually changes the outcome when documented out-of-pocket loss plus mitigation costs are in the low four figures or higher, when the fraud is recent enough that mitigation is ongoing, and when the company is a real business with assets. It is less likely to change the outcome when the only loss is speculative anxiety, when the fraud has been fully reimbursed and the only remaining damage is monitoring fees of a few hundred dollars, or when a class action is already pending and your claim will be absorbed there.

What I review when you send a Washington identity-theft matter

When you send the file I read the breach notice, the credit reports, the fraud documentation, and the receipts; I walk Ch. 19.255 and Ch. 19.86 against the specific facts; and I form a candid view of whether a $575 attorney-drafted demand letter is the right move, whether the matter should go directly to a class case or to AG referral, or whether the recovery is too small to justify a paid letter. The output is a written evaluation, not a sales pitch.

Primary sources

• RCW 19.255.010: breach definitions, consumer notice, AG notice, encryption safe harbor.
• RCW 19.255.020: processor and vendor notice allocation.
• RCW 19.255.030: federal-law / HIPAA covered entities and Gramm-Leach-Bliley financial institutions.
• RCW 19.255.040: consumer protection section. AG CPA-style enforcement plus consumer civil action for damages and injunctive relief. Statute itself precludes action to enforce Chapter 19.255 from being brought under RCW 19.86.090.
• RCW 19.86.020: substantive prohibition on unfair or deceptive acts.
• RCW 19.86.090: CPA private action, treble enhancement capped at $25,000, attorney's fees, available only for an independent Chapter 19.86 claim.
• RCW 19.86.093: public-interest paths.
• RCW 19.86.120: four-year statute of limitations.

This page is an educational resource. Sergei Tokmakov is a California attorney (CA Bar #279869) currently seeking admission to the Washington State Bar. Nothing on this page creates an attorney-client relationship, and nothing on this page is Washington legal advice for a specific matter. A Washington-admitted attorney should verify both the operative statute text and any case citations before relying on them in court or correspondence on a live dispute.