AegisAI Perspectives · 049
A financial firm must notify the FTC within 30 days of discovering an email breach that exposes unencrypted data of 500 or more consumers, by web form.
A financial firm must notify the FTC as soon as possible, and no later than 30 days after discovery, when an email breach exposes unencrypted customer information of at least 500 consumers14. AegisAI reads sign-ins and mailbox activity per account, so a takeover surfaces as one explained finding14. The 30 days start on the first day any employee, officer or agent other than the attacker knows of the event2.
This page covers one clause of the FTC Safeguards Rule, 16 CFR 314.4(j), as it applies to an email breach. The wider controls and rules for a financial firm are in email security for financial services: controls and rules. It explains the regulation text and the Federal Register notice that adopted it; it is not legal advice.
Seven steps run from the discovery date in 314.4(j)(2) to a filed FTC form or a written decision not to file.
Fix the discovery date. Record the first day any employee, officer or other agent, other than the person committing the breach, knew of the event.
Scope what the attacker reached. Export the sign-in window, the mailboxes opened, new forwarding or inbox rules and the messages read or sent from the account.
Search the reachable mail for customer information. Run the search across messages and attachments, and keep the search terms with the incident record.
Test each item for encryption. Data counts as encrypted only when it leaves a low probability of assigning meaning without the key, under current cryptographic standards6. It counts as unencrypted when an unauthorized person accessed the key5.
Apply the access presumption. Unauthorized access to unencrypted customer information is presumed to be acquisition, unless the firm has reliable evidence that there was no unauthorized acquisition4.
Count distinct consumers. The notice duty starts at 500 consumers. Remove duplicates across mailboxes before you compare the total with the threshold.
File on the FTC form as soon as possible, and inside 30 days. The form asks for six items, from the firm's contact details to any law enforcement determination3. Consumer notice is a separate duty under state breach laws12.
Step 4 depends on how customer data travels by email in the first place, which is covered in does the FTC Safeguards Rule require email encryption for customer information.
AegisAI account takeover protection, in early access, weighs impossible travel, new devices, inbox rule changes and suspicious internal sends together for each account13. Agents read sign-ins and mailbox activity per account and raise one explained finding when behavior stops matching the owner. The team then acts in Entra ID, Okta or Google Workspace. It runs review-only on the same API connection as inbound email plus audit log access, and on Microsoft 365 the sign-in reports need Entra ID P115.
The decision turns on four questions: was the data unencrypted, was it acquired, how many consumers, and when did staff know. The table maps common mailbox findings to the rule text.
| Mailbox finding | Effect on the FTC notice | Rule text |
|---|---|---|
| Attacker signed in and could read mail holding customer information | Presumed acquisition, so a notification event unless reliable evidence rebuts it | 314.2(m) |
| Customer data in a file encrypted to current standards, key never exposed | Not unencrypted customer information, so no notification event for that file | 314.2(f) |
| Encrypted file whose key or password the attacker accessed | Treated as unencrypted | 314.2(m) |
| Fewer than 500 consumers affected | No FTC notice under 314.4(j); state breach laws can still apply | 314.4(j)(1) |
| 500 or more consumers affected | Notice as soon as possible, no later than 30 days after discovery | 314.4(j)(1) |
| Law enforcement says public notice would impede an investigation | The FTC notice is still filed; public disclosure is delayed | 314.4(j)(1)(vi)11 |
The box below runs one email breach through the seven steps, with the days counted.
Illustrative example, figures are fictional. Harbor Rise Lending is a fictional mortgage lender under FTC jurisdiction. On Tuesday 3 March, at 16:40, an IT analyst reads an alert: a loan officer's mailbox signed in from a first-seen device and created a rule that moves mail containing "statement" to an archive folder.
Discovery day is 3 March, because an employee knew of the event that day. The FTC deadline is therefore 2 April.
The audit log shows the attacker held the session for 31 hours. The mailbox held 1,140 messages with loan applications or bank statements attached. After removing duplicates, the attachments name 640 consumers. For 90 of them the files were password protected, and the passwords were sent by text message, never by email, so those files stay encrypted. The remaining 550 consumers are over the threshold.
The audit log cannot show which messages the attacker opened, so the firm has no reliable evidence against acquisition. It files the FTC form on 19 March with all six items. No law enforcement official asked for a delay. Counsel handles the state consumer notices on a separate track.
It is a duty to report certain security events to the FTC, set out in 16 CFR 314.4(j). The duty applies when a notification event involves at least 500 consumers, and the deadline is 30 days after discovery. Section 314.4(j) took effect on May 13, 20249.
Part 314 implements sections 501 and 505(b)(2) of the Gramm-Leach-Bliley Act8. It covers financial institutions under FTC jurisdiction that are not subject to another regulator's enforcement authority under section 5057. A firm under another regulator's section 505 authority is outside Part 314.
The notice goes to the FTC only. The FTC left consumer notice out because every state already has some form of consumer notification law.
It triggers when one notification event involves the information of 500 or more consumers. The count is of people. A customer named in many emails is one consumer.
The FTC first proposed 1,000 consumers and lowered the number to 500 in the final rule, noting that the HIPAA breach rule and its own Health Breach Notification Rule also use 50010. The notice reports the number of consumers affected or potentially affected. The form counts consumers potentially affected as well as those affected.
An email compromise qualifies when an attacker acquires unencrypted customer information without the customer's authorization. In a mailbox, access is enough to start: the rule presumes that unauthorized access to unencrypted customer information is acquisition.
The firm overturns that presumption only with reliable evidence that there was no unauthorized acquisition. For a mailbox, look for that evidence in the audit log: which items the session opened, downloaded or synced. The attack chain behind a mailbox compromise, from stolen session to hidden rule, is set out in how email account takeover works.
Encryption is the other exit. A file the attacker opened stays outside the rule only if it meets the encryption definition and the key was not accessed. A mailbox opened through a stolen session shows its messages as readable text to whoever holds the session.
Six items, filed electronically on the form on the FTC website:
The rule says as soon as possible, and no later than 30 days after discovery. A law enforcement delay does not move it. The official may ask for an initial delay of up to 30 days after the FTC notice, and up to 60 days more in writing, and the delay applies to public disclosure.
Keep four records from the start of the incident. They are the discovery record, the scope export, the encryption and acquisition decision, and the consumer count. Each one answers a field on the FTC form or a step in the rule.
Write the discovery record when the first person outside the attacker knows, since that day starts the 30 days. Pull the scope export from the mail platform's audit log before retention removes it. Write the acquisition decision against the rule text, naming the evidence or the lack of it. Keep the consumer count with its method, because the form asks for the number.
Assign one owner for the FTC filing and one for state consumer notices. They are separate duties with separate rules.
Track three numbers for every mailbox incident, from the incident tracker and the mail audit log.
As soon as possible, and no later than 30 days after discovery, when the breach involves unencrypted customer information of at least 500 consumers. Discovery is the first day any employee, officer or agent other than the attacker knows.
No. The Safeguards Rule notice goes to the FTC only. The FTC left out a consumer notice duty because every state already has some form of consumer notification law.
Not under 314.4(j), which starts at 500 consumers. State breach laws still apply to the same event. Keep the count and its method in the incident file.
The FTC notice is still filed on time. A law enforcement official may ask for an initial delay of up to 30 days after that notice, and up to 60 days more in writing, for public disclosure. The notice says whether such a determination exists.
Yes, if it meets the encryption definition and the key stayed safe. Data counts as unencrypted when an unauthorized person accessed the encryption key.
Financial institutions under FTC jurisdiction that are not subject to another regulator's enforcement authority under section 505 of the Gramm-Leach-Bliley Act. The notice duty has applied since May 13, 2024.
