Which of the following best describes a 'security breach' under the FACT Act?

• A. A breach occurs only when financial loss is observed by the organization.
• B. Unauthorized access or acquisition of consumer information; the organization must notify affected individuals and mitigate risk.
• C. A breach is defined only for physical records that are stolen.
• D. A breach is only defined if consumer credit is harmed.

Answer: (B)

Security breaches under the FACT Act involve unauthorized access or acquisition of consumer information that could compromise the security, confidentiality, or integrity of that information. This triggers the obligation to notify affected individuals and to take steps to mitigate the risk of harm, such as improving safeguards or offering protections like credit monitoring. It doesn’t depend on observed financial loss, nor is it limited to physical records or to cases where consumer credit is harmed. That combination of unauthorized access and the required protective actions is what makes the described option the best match.