For nearly a decade, the Connecticut Attorney General (“AG”) has requested or encouraged companies to provide at least two years of free credit monitoring to Connecticut residents following breaches involving information relating to those individuals. On June 11, 2015, Connecticut Governor Malloy signed into law a bill (“SB 949”) that will actually require companies to offer free credit monitoring to Connecticut residents. Connecticut now joins California as the only other state that has some form of credit monitoring requirement for breaches.

Specifically, effective October 1, 2015, SB 949 will require a company that experiences a noticeable breach involving a Connecticut resident’s name and Social Security number (“SSN”) to offer that individual, at no cost, “appropriate identity theft prevention services and, if applicable, identity theft mitigation services” for a period of not less than one year. For such a breach, SB 949 will require that the notice to the Connecticut resident include information on how to enroll in the free service, as well as information on how the individual can place a credit freeze on her credit file (similar to the Massachusetts breach law).