On October 5, 2026, The Winn-Dixie Company, LLC filed a breach notification with Massachusetts. The sample consumer letter it filed, on letterhead reading 5050 Edgewood Ct, Jacksonville, FL 32254, tells the recipient there was "a data security incident that involves your personal information," offers 24 months of Experian IdentityWorks, and stops. No incident date, no cause, no section naming what information was involved.
The facts are in the other document. The state's 2026 Data Breach Notification Report carries the same filing as row 2026-1712: reported 05-Oct-26, retail, 2 Massachusetts residents affected, SSN breached Yes, medical records no, financial account no, driver's licenses no, credit/debit numbers no.
Several breach-aggregator sites read the empty letter as withholding. Massachusetts law prohibits the letter from saying any of it.
One duty, two documents, opposite contents
M.G.L. c. 93H §3(b) governs both filings. The report to the Attorney General and the Director of Consumer Affairs and Business Regulation "shall include, but not be limited to" nine enumerated items, (i) through (ix). Among them:
(i) the nature of the breach of security or unauthorized acquisition or use; … (vi) the person responsible for the breach of security, if known; (vii) the type of personal information compromised … (viii) whether the person or agency maintains a written information security program; and (ix) any steps the person or agency has taken or plans to take relating to the incident, including updating the written information security program.
The notice to the resident, in the same subsection, gets four items — the right to obtain a police report, how to request a security freeze, that there is no charge for one, and the mitigation services — followed by this:
provided, however, that said notice shall not include the nature of the breach of security or unauthorized acquisition or use, or the number of residents of the commonwealth affected by said breach of security or unauthorized access or use.
The same subsection that compels the nature of the breach into the regulator filing bans it from the mailbox. Read the Winn-Dixie letter against those four items and it is not a lazy template: it carries all four, and nothing the statute forbids. Someone drafted it to the statute.
This is reproducible rather than anecdotal. A second company, Access Residential Management, filed the same day as row 2026-1713, through a different notification vendor — Cyberscout rather than Experian — on an entirely different template. Its letter says only "the recent data security event experienced by Access Residential Management … that may have affected your personal information." Two vendors, two templates, the same silence, because the silence is statutory.
As of October 12, 2026, no public source establishes how anyone got into Winn-Dixie. The extortion group Anubis listed "winndixie.com" on its leak site on August 3, 2026 at 17:51 UTC, described only as "Inside a multibillion-dollar retail giant" — an attacker claim, 63 days before the Massachusetts filing, and the familiar pattern where your name goes public on the attacker's schedule first. The leak-site claim and the notice's reported data type are separate records, and this piece does not join them.
The practice: shard the template, and answer item (viii) before you need it
A notification letter cannot be one document. If a single paragraph describes the incident and ships to every recipient, it is non-compliant in Massachusetts — and if you strip it globally to be safe, you fail the states that require it. The template has to be state-conditional, and the state list comes from where your residents are, not where your offices are.
The cost is real: every variant is a separate legal review, and variants drift. The workable version is one base letter with the incident description as a conditional block rather than a per-state rewrite, built on the jurisdiction matrix that already has to exist because the notification deadline and the definition of discovery differ by state. Adding a content rule to a matrix you maintain anyway is cheap. Maintaining fifty letters is not.
Then item (viii). Whether you maintain a written information security program is a question you answer in writing, under your own name, to a state Attorney General, inside a window the statute defines as "as soon as practicable and without unreasonable delay." It is not a yes-or-no to research mid-incident, and item (ix) compounds it — the steps taken or planned "including updating the written information security program." Answering (viii) commits you to (ix).
If the honest answer is no, file no; 201 CMR 17.00 has required a WISP of anyone holding personal information about a Massachusetts resident since 2010, and a breach filing is an expensive place to discover that. Item (vii) has the same shape: naming the type of personal information compromised depends on knowing what is in your repositories before the incident, not after.
How to check
- Pull your notification template. Is the incident description state-conditional, or does one version ship to everyone?
- Ask who can answer item (viii) in writing today. If it takes more than a day to produce, that is the finding.
- Confirm your jurisdiction matrix carries a content column, not just a deadline column.
- Check the template for the four items Massachusetts requires: police report, freeze procedure, no charge for the freeze, mitigation services.
- Know who reads the state breach report your row lands in. It is public within ten business days of verification; the letter you mailed is not the version of record.
North InfoSec runs AI-assisted penetration testing and security assessments, including the written information security program work that item (viii) asks about. northinfosec.com