When a data breach occurs, most states have laws in place that require notification of the breach to anyone who has personal information compromised. At least 40 states have such laws, but by the time victims receive notification about the breach, they may already be victims of identity theft.