The revised figure appears in the U.S. Department of Health and Human Services Office for Civil Rights breach portal. HHS lists CareCloud, Inc., as a New Jersey business associate reporting a hacking or information-technology incident. The breach submission date shown in the federal record is July 24, 2026.

For people who received an earlier CareCloud notice, the updated figure means the first estimate should not be assumed to represent the final scope. The HHS number is an affected-population count. It does not establish that every person had an entire medical record stolen or that the same information was exposed for everyone.

Why the CareCloud count changed

Earlier state disclosures and reporting put the potentially affected population at approximately 345,000 to 350,000 people. Independent reporting in August described the later federal total as roughly 3.75 million.

CareCloud provides electronic-record and healthcare technology services to providers across the United States. Because the company supports providers in multiple states, the incident is not necessarily limited to New Jersey residents, even though HHS lists the company in New Jersey.

What happened in March

CareCloud’s March 24 Form 8-K said the company discovered a temporary network disruption on March 16. The disruption affected functionality and data access in one of six electronic health record environments for approximately eight hours before service was restored.

In that initial filing, CareCloud said it was still determining whether information had been accessed or exfiltrated. The company’s later Form 10-Q said unauthorized access began approximately one week before the March 16 discovery and that subsequent forensic analysis indicated an undetermined amount of data was exfiltrated.

State disclosures and independent reporting describe access to an AWS-hosted or cloud-supported patient-data environment during approximately March 10 through March 16. CareCloud said the incident was contained and that it believed the threat actor no longer had access. That remains the company’s assessment, not an independent finding.

What information may be involved

Independent reports and breach notifications have described potentially exposed information including names, postal addresses, Social Security numbers, government-issued identification numbers, bank-account or payment-card information, and medical or health information.

The combination of health information with identity and financial details can create long-term risks. Those include identity theft, medical identity theft, insurance fraud and targeted phishing that uses personal healthcare details to appear credible.

What affected people should do now

• Verify communications independently. Do not use links or phone numbers in a suspicious email, text or letter. Contact CareCloud or the relevant healthcare provider through a trusted website, statement or previously known number.
• Review credit activity. Check credit reports and account statements for unfamiliar activity. Consider placing a fraud alert or credit freeze with the major credit bureaus.
• Watch medical records and insurance statements. Look for unfamiliar services, prescriptions or insurance claims.
• Secure reused passwords. Change passwords reused on affected accounts and enable multifactor authentication where available.
• Keep documentation. Save breach notices, account records and correspondence. They may help with disputes, identity-theft reports or future claims.

The Federal Trade Commission directs consumers affected by data breaches to monitor accounts, consider credit protections and use federal identity-theft recovery resources if misuse appears.

What remains unknown

The public filings do not establish the exact amount or categories of data exfiltrated for each person. CareCloud’s Form 10-Q also says the company has been served with two patient class-action complaints and anticipates possible additional complaints. Those are company-reported legal matters, not adjudicated findings of wrongdoing.

The investigation and notification process may continue. People who received an earlier notice should follow updates from HHS, the FTC, CareCloud and their healthcare providers rather than treating the original estimate as final.

Sources

• HHS Office for Civil Rights Breach Portal
• CareCloud Form 8-K
• IT Pro: CareCloud breach estimate revised
• Federal Trade Commission data-breach resources

Unlimited Technology Systems, a third-party provider of practice-management software and revenue-cycle services, says an unauthorized actor obtained copies of some individuals’ information between October 5 and October 10, 2025. The company discovered unauthorized activity in its commercial data center on October 19, 2025, according to state filings and the sample consumer notice.

Unlimited began providing notices on approximately July 21, 2026, and is sending them on a rolling basis. That rollout is what makes the incident newly relevant for patients who may not have known that a vendor serving their medical provider was involved.

Why one vendor’s breach can reach many patients

Unlimited provides administrative, practice-management and financial technology services to healthcare organizations and providers. Its role as a third-party vendor means information from patients at unrelated medical practices may have been stored or processed through the same company.

Provider notices describe Unlimited as the vendor involved in the incident. One provider notice says the incident did not involve that provider’s own computer systems or disrupt patient care. That does not mean every patient at an affected practice was involved: notices are being sent to individuals identified through reviews by Unlimited and the relevant data owners.

What information may be involved

The categories varied by individual. Depending on the person, potentially involved information may include:

• Names, dates of birth and demographic information;
• Social Security numbers, driver’s licenses or other government identification;
• Email addresses, physical addresses and phone numbers;
• Insurance cards, policy and claims information, intake forms and patient-balance information; and
• Medical record numbers, dates of service and diagnosis information.

The notices do not establish that every listed category was exposed for every person who receives a letter. Some provider notices also say Social Security numbers may have been involved for only some patients.

What the notice says was not involved

Unlimited’s sample notice says full patient medical records, medical imaging, credit-card information and bank-account information were not involved. The same notice separately lists medical record numbers, dates of service and diagnosis information as data that may have been involved, so patients should read their individualized letters rather than assume that all health-related information was excluded.

Unlimited says it was unaware of any attempted or actual misuse of the information when the notices were issued. The disclosure does not establish that notified individuals have experienced identity theft.

How large is the incident?

TechRadar reported on August 10, 2026, that the broader incident may affect approximately 3.8 million people. That is an independent report of the national scope, not a final government-confirmed count presented in the state filings cited here.

Other reporting has described at least 442,000 affected patients based on notices and disclosures available at the time. State records show the incident reaches multiple states: an Iowa filing lists 162,478 Iowa residents, while a South Carolina state record lists 148,342 affected residents.

Those figures illustrate how a breach at a healthcare technology vendor can spread across multiple provider networks. They should not be added together as a national total because the available reports may cover overlapping or differently updated populations.

What notified consumers should do

Individuals who receive a letter should use the contact information in that notice and activate the offered services before the deadline printed in the letter. Unlimited says notified individuals are being offered 24 months of identity monitoring, fraud consultation and identity-theft restoration through Kroll. Monitoring can help identify suspicious activity, but it does not prevent fraud or guarantee reimbursement.

Consumers should review their credit reports, bank and payment-account statements, insurance explanations of benefits and medical-account activity for unfamiliar changes. A one-year fraud alert may be appropriate for some people. Those seeking stronger protection can consider a security freeze with each of the three major credit bureaus.

Anyone who sees suspected identity theft or unauthorized financial activity should contact the relevant financial institution and appropriate authorities promptly. People who believe they may be affected but did not receive a notice can call Unlimited’s incident-response line at 844-576-3063.

Sources

• Iowa Attorney General breach notification filed by Unlimited Technology Systems
• California Attorney General sample individual notice
• TechRadar report on the approximately 3.8 million figure
• South Carolina Department of Consumer Affairs breach notice listing

The advocate’s Fiscal Year 2027 Objectives Report to Congress describes a mixed filing season. The IRS processed nearly 139 million individual returns and issued more than 90 million current-year refunds. About 98% of individual returns were filed electronically. About 98% of refunds were delivered by direct deposit, although the report notes that the IRS’s direct-deposit and refund totals are not directly comparable because they include different tax-year populations.

Those topline figures do not capture the experience of millions of people whose returns were suspended, whose refunds could not be sent electronically or whose cases required identity-theft assistance.

Where automated processing breaks down

More than 14 million individual returns were suspended during processing for additional review. A suspension is not, by itself, a finding of fraud or identity theft. It can mean that an IRS filter flagged a return and the agency needs more information or verification before releasing a refund.

More than 1 million taxpayers did not receive refunds within the IRS’s normal processing time. Those taxpayers waited an average of about 5.5 weeks, according to the report. Other taxpayers experienced shorter delays that remained within the agency’s normal time frame.

The delays can be financially significant for households relying on a refund for rent, groceries, medical bills or other expenses. The report says taxpayers who need individualized help often struggle more than those whose returns can be completed through automated systems.

Phone access was also uneven. Across IRS telephone lines, assistors answered about 21% of 48.1 million calls during the filing season, compared with 25% of calls in the prior filing season. The report says some high-volume lines performed particularly poorly, including the Taxpayer Protection Program line used by people whose returns were suspended because of suspected identity theft.

Why paper-refund recipients faced extra obstacles

The IRS generally shifted toward electronic payments during the filing season. That approach does not work for everyone. People who are unbanked or underbanked, some older taxpayers, certain taxpayers living overseas and others without practical access to electronic payments may need a paper check.

By April 27, the IRS had issued about 4 million notices involving returns that lacked valid direct-deposit information or contained incorrect information. The notices generally directed taxpayers to use an online account to update payment information or request an exception for a paper check.

The National Taxpayer Advocate said the process was confusing because many taxpayers did not have online accounts or could not create them. The notices also did not clearly provide all the information needed to request an exception. The report says paper-refund problems caused delays of six weeks or more in some cases.

Identity-theft cases can take nearly two years

Identity-theft cases remained one of the most serious service problems. More than 500,000 cases were still pending at the end of the filing season, and the average resolution period was about 20 months.

That is an average, not a guaranteed wait for every taxpayer. But the backlog can leave affected households waiting for refunds long after ordinary processing timelines have passed.

Taxpayers who receive a CP5071-series notice or Letter 5447C should follow the instructions on the notice and use the official IRS verification service when available. The IRS says taxpayers should have the notice and the relevant Form 1040 return available. After verification, the agency says taxpayers should wait two to three weeks before checking refund status, and processing can take up to nine weeks.

What taxpayers should do

• Read every IRS notice carefully. Use the notice number and tax year to identify the required response and deadline.
• Verify identity only through official IRS tools. Do not send Social Security numbers, tax returns or bank information through unofficial websites, messages or callers claiming to represent the IRS.
• Check an IRS Online Account and Where’s My Refund? These tools provide different information. An online account can show notices and account details, while the refund tracker provides status updates.
• Consider an Identity Protection PIN. An IP PIN can help prevent someone else from filing a federal return using a taxpayer’s Social Security number or ITIN.
• Seek additional help when ordinary channels fail. Taxpayer Assistance Centers offer in-person service by appointment. The Taxpayer Advocate Service may help when a taxpayer faces financial hardship or cannot resolve a serious problem through normal IRS channels.

What happens next

The report sets out the Taxpayer Advocate Service’s priorities for fiscal year 2027, including reducing identity-theft delays, improving communication when returns are suspended and making paper-refund procedures clearer.

Those priorities are recommendations and advocacy objectives, not completed IRS reforms. The report’s central distinction is that digital-first tools can serve many taxpayers well, but they cannot replace meaningful telephone, in-person, correspondence and case-resolution options for people with unusual circumstances or limited digital access.

For taxpayers, the practical lesson is simple: a strong filing-season topline does not mean every refund is moving normally. If the IRS freezes a return or requests identity verification, the notice and official IRS tools are the starting point; if those channels fail and the delay creates serious hardship, in-person assistance or the Taxpayer Advocate Service may be the next step.

Sources

• IRS: National Taxpayer Advocate issues 2026 mid-year report to Congress
• Taxpayer Advocate Service: FY 2027 Objectives Report to Congress
• Associated Press: IRS watchdog cites long phone waits during tax season

The company began sending formal notices on July 10, 2026, after completing its review of potentially affected files on June 15. An Indiana attorney general breach listing reports that 237,141 Indiana residents were affected; the filing lists the national total as 6,998,886. The Indiana figure is a state-specific count and does not mean all affected people lived in Indiana.

What changed

The incident itself occurred in March. AssuranceAmerica says it detected suspicious activity on March 17, while the Indiana filing lists March 16 as the breach date. The company says the activity appeared to target an employee and that an unauthorized third party accessed parts of its information-technology environment and copied data files.

AssuranceAmerica says it investigated the incident, worked to determine which files were involved and completed that review on June 15. The notification period began July 10, making the current issue for consumers the formal notice and response period rather than a newly discovered attack.

What information may be involved

The company’s notice says the potentially exposed information may include names, addresses and other contact details; insurance policy or account information; driver and vehicle information; claims data; and driver’s-license numbers.

For some individuals, the information may also include Social Security numbers or tax-identification information. The notice does not say that every affected person’s record contained every category.

The combination of insurance records, driver information and identity details can make phishing or impersonation attempts more convincing. A message that references a policy, vehicle, claim or license should not automatically be treated as legitimate simply because it includes personal information.

What AssuranceAmerica says it did

According to the company’s notice, affected systems were taken offline, passwords were reset and additional monitoring and threat-detection tools were put in place. AssuranceAmerica also says it expanded employee instruction and notified law enforcement.

The company is offering eligible recipients 12 months of IDX credit monitoring. Consumers should use the enrollment instructions in their individual notice and activate the service by the deadline printed in that letter. Credit monitoring can help identify certain signs of misuse, but it does not prevent identity theft by itself.

What affected consumers should do

First, verify that a notice is genuine. Do not rely on an unexpected email or text message asking for information. Use the contact details in the letter or another trusted company contact method, and avoid clicking links in unsolicited messages.

If you received a notice, enroll in the offered IDX service before its stated deadline. Review your credit reports, bank statements, insurance accounts and claims activity for unfamiliar changes.

Consumers whose Social Security or tax-identification information may have been included should consider placing a free credit freeze with Equifax, Experian and TransUnion. A fraud alert is another free option that asks lenders to take additional steps to verify identity before opening new credit.

Anyone who suspects identity theft should report it through IdentityTheft.gov and contact the affected financial institution, insurer or account provider promptly.

What remains unknown

AssuranceAmerica has not publicly identified the person or group behind the incident. The available notice also does not establish the precise method used to target the employee, whether the information was publicly released or whether it was sold. The company’s account confirms unauthorized access and copying of files, but not those additional details.

Sources

• Indiana Attorney General, June 2026 Data Breach Report
• AssuranceAmerica individual data-security incident notice
• TechCrunch report on the AssuranceAmerica breach
• Federal Trade Commission, “What To Do After a Data Breach”

The national warning is part of the five-week “Protect Your Clients; Protect Yourself” campaign launched July 7, 2026. The campaign is being reinforced through the IRS Nationwide Tax Forums, including the New Orleans forum taking place August 4-6.

What the IRS is warning about

The campaign identifies several schemes aimed at tax professionals. They include IRS impersonation by email, text, phone or direct message; misleading tax advice posted on social media; malicious messages from supposed new clients; and attempts to steal professional credentials and records, including an Electronic Filing Identification Number, or EFIN, a Preparer Tax Identification Number, or PTIN, and Centralized Authorization File, or CAF, information.

The IRS says criminals may pose as prospective clients and send links or attachments disguised as tax documents. Preparers are being urged to verify unusual requests through trusted channels instead of clicking unexpected links or opening files from unfamiliar contacts.

Why taxpayers can be affected

Taxpayers may not know when a preparer’s system has been compromised, but stolen Social Security numbers, income records or tax-account information can be used to submit fraudulent returns. A return can also be selected for identity verification, delaying a refund even when the taxpayer filed a legitimate claim.

The Taxpayer Advocate Service reported that, from January 1 through April 18, 2026, the IRS selected about 2.6 million returns for review through its Taxpayer Protection Program and released about 1.2 million of the associated refunds. The report said 887,000 refunds were released after taxpayers completed identity verification, while 269,000 were released using IRS records without taxpayer interaction.

Those selections do not mean every return was fraudulent. The Taxpayer Advocate Service has warned that IRS filters can also hold legitimate returns, creating delays while taxpayers verify their information.

The watchdog also reported that more than 500,000 identity-theft victim assistance cases remained open and that victims were waiting about 20 months on average for the IRS to resolve their cases or release refunds. That is an identity-theft case-resolution figure, not the normal timeline for an IRS refund.

Safeguards the IRS is emphasizing

The IRS is telling tax professionals to use multifactor authentication, train employees, verify unusual requests and keep security procedures current. It also says tax professionals must maintain a written information security plan under applicable law.

The plan should be tailored to the size, scope and complexity of the business and to the sensitivity of the customer information it handles. IRS guidance says the plan should address employee training, information systems, system failures, risk assessment, safeguards and oversight of service providers. It should also be reviewed and updated as the business changes.

If a tax professional suspects a data breach, the IRS says the incident should be reported quickly to the agency’s Stakeholder Liaison and to the appropriate state tax agency. Early reporting can give the IRS a chance to block fraudulent returns filed in clients’ names and help guide the preparer through the response process.

Steps taxpayers can take

People who use a paid preparer can ask how the firm protects client data, whether it uses multifactor authentication and whether it maintains a written information security plan. Taxpayers should be cautious about unsolicited messages requesting passwords, tax credentials, payment information or an Identity Protection PIN.

Taxpayers with a Social Security number or Individual Taxpayer Identification Number can request a free IRS Identity Protection PIN. The PIN is a unique six-digit number known to the taxpayer and the IRS and is issued for use on federal tax returns. It helps verify the taxpayer’s identity, but it is not a guarantee against every type of tax fraud and does not promise an immediate refund.

The IRS says taxpayers must verify their identity before receiving an IP PIN. People who cannot complete the process online or by phone may have other options, including submitting Form 15227 when eligible or making an appointment at a Taxpayer Assistance Center.

What happens next

The IRS forums and summer campaign provide guidance and prevention measures; they do not create new tax rules or enforcement powers. After the New Orleans session, the remaining 2026 Nationwide Tax Forums are scheduled for New York City on August 18-20, Orlando on September 1-3 and San Diego on September 15-17.

Sources

• Taxpayer Advocate Service filing-season report
• IRS written security plan guidance

The Federal Trade Commission said Amazon agreed to pay a $2.25 million civil penalty to resolve allegations that it violated the Fair Credit Reporting Act by failing to provide certain records to identity-theft victims within the law’s 30-day timeframe. The United States filed the complaint in federal court on June 29, 2026.

The case remains listed as pending on the FTC’s case page. The parties filed a proposed stipulated order, and Amazon neither admits nor denies the complaint’s allegations under that proposed order. The $2.25 million is a civil penalty payable to the United States, not a consumer refund program.

What Section 609(e) allows victims to request

Section 609(e) of the Fair Credit Reporting Act generally requires a business that provided goods, services or credit, accepted payment or otherwise entered into a commercial transaction involving someone who allegedly used another person’s identity without authorization to provide relevant application and business transaction records.

The records may help a victim or an investigating officer understand how a fraudulent account was opened or used. They may include information that identifies the alleged identity thief, but the law does not guarantee that the documents will identify the person responsible or lead to recovery of lost money.

The right is also limited. It does not require a company to provide every kind of data, and the statute excludes Internet navigational data and similar information about a person’s visit to a website or online service.

A request generally must be made in writing and sent to the address the business designates. The records may be sent to the victim or, if the victim specifies or authorizes it, directly to a federal, state or local law-enforcement agency.

What to include in a request

Federal guidance and the proposed Amazon order say a business may require documentation showing both the requester’s identity and the identity-theft claim. That can include:

• A government-issued identification document;
• A police report; and
• A completed identity-theft affidavit.

Consumers should identify the suspected fraudulent account or transaction as specifically as possible, keep copies of everything submitted and use a delivery method that documents when the business received the request. They should send the request to the company’s designated address or channel, rather than relying only on a general customer-service conversation.

How the 30-day deadline works

Section 609(e) says the business must provide covered records no later than 30 days after receiving a qualifying request. The proposed Amazon order states that the 30-day period applies after Amazon receives the request, any preferred contact information it requires in good faith and any verification documents it requires in good faith.

That makes the paper trail important. Consumers should record the date they sent the request, the date of delivery, the designated business address, the documents included and the names or reference numbers from follow-up contacts. If a company says the request is incomplete, ask in writing what specific information is missing.

What the complaint alleges about Amazon

The complaint alleges that Amazon sometimes gave victims or authorized law-enforcement representatives explanations that obstructed access to records. The allegations include references to security or privacy concerns, requests that victims guess the name of the person who opened the fraudulent account, claims that representatives could not access the records and demands for subpoenas from law enforcement.

The filing also alleges delays and refusals in circumstances where the statute generally does not make a subpoena a prerequisite for an authorized law-enforcement request. It alleges that Amazon failed in some cases to provide records or even issue a denial within 30 days.

Those descriptions remain allegations. The proposed stipulated order would permanently bar the challenged practices, require Amazon to maintain a process for receiving Section 609(e) requests and require a website notice explaining how victims can request records. It would also require Amazon to identify certain eligible victims who previously submitted written requests but did not receive responsive records, then notify them about the process for requesting records again. The order would take effect only if entered by the court.

When a company may refuse

Section 609(e) does not create an unlimited right to every record. A business may decline a request in specified circumstances, including when it determines in good faith that the law does not require disclosure, lacks a high degree of confidence in the requester’s identity, finds that the request contains a relevant misrepresentation or determines that the information is excluded Internet navigational data.

The statute also recognizes a defense when the requested records do not exist or are not reasonably available after a reasonably diligent search. A company’s general security or privacy concern, a demand that the victim guess the alleged thief’s name or a representative’s lack of personal access is not automatically one of the listed grounds for denial.

What to do if a company refuses or does not respond

Ask for the denial and the reason in writing. Preserve the request, delivery confirmation, attachments and all responses. If law enforcement is investigating, provide the agency with the records and correspondence and ask whether it should submit its own authorized request.

Victims should handle related credit-reporting steps separately. The Consumer Financial Protection Bureau advises consumers to report identity theft, consider a fraud alert or credit freeze and dispute fraudulent accounts with the nationwide consumer-reporting companies. A transaction-record request does not replace those actions.

If the business does not respond within the applicable 30-day period or appears to impose requirements the law does not support, consumers can consider filing a complaint with the FTC or CFPB and contacting the relevant law-enforcement agency. The federal right is limited, but a careful written request can give victims and investigators access to records that may otherwise be difficult to obtain.

Sources

• FTC guidance on identity-theft transaction records
• CFPB identity-theft recovery guidance

The figure covers breach notices received from January 1 through June 30. It is a total of reported affected residents, not a count of 1,131,320 uniquely identified people. The department’s broader reporting guidance says totals can be minimum figures when organizations cannot determine everyone affected.

Financial businesses reported the largest share

Forty-one businesses reported breaches during the six-month period. Financial businesses filed 12 notices involving 801,652 South Carolina residents.

Hospitality businesses reported four breaches affecting 154,455 residents. Education businesses reported three breaches affecting 91,842 residents.

A small number of large notices drove much of the statewide total. AssuranceAmerica Managing General Agency reported 611,046 affected South Carolina residents on June 18. Carnival Corporation reported 134,156 on May 28.

Those two notices together account for 745,202 reported residents, or about 66% of the first-half total. That calculation does not mean every person experienced the same exposure. The data involved can differ from one notice to another, so residents should read the notice from the organization involved.

Later registry entries are outside the first-half total

The South Carolina Department of Consumer Affairs’ public registry was updated through July 23, 2026. It includes notices reported after June 30, including MCBS, LLC, which listed 295,625 affected South Carolina residents on July 1, and Unlimited Technology Systems, LLC, which listed 148,342 on July 21.

Those entries should not be added to the 1,131,320 first-half total. The July 6 report measured notices received during the January-through-June period, while the registry continues to change as businesses submit additional notices.

What the state registry shows

South Carolina businesses must notify residents when their personal information is breached. When a business sends notice to 1,000 or more South Carolina residents at one time, it must also notify the Department of Consumer Affairs and provide a copy of the consumer notice. Notices received by the department are posted publicly.

The registry can show the organization, reporting date and reported number of affected South Carolina residents. It is not a complete count of every breach or every affected person. The department says the affected-resident field may be blank when a business does not know the number. Businesses reporting a breach affecting fewer than 1,000 South Carolina residents may also choose whether to provide the department with a copy of the notice.

The department’s 2026 historical report says some organizations were unable to determine a precise number of affected consumers even after investigating. In those cases, the reported totals represent minimum numbers, not an independently audited count of every person whose information may have been exposed.

Steps to take after receiving a notice

Residents who receive a breach notice should act promptly rather than wait for evidence of fraud.

• Change the password for the affected account and any other account where the same password was used.
• Turn on multifactor authentication and use unique passwords for important accounts.
• Review bank, credit-card and other financial statements for unauthorized activity.
• Obtain free credit reports through AnnualCreditReport.com.
• Consider placing a fraud alert with a credit-reporting agency. An alert requires businesses to take additional steps to verify identity before issuing credit or services in your name.
• Consider placing a security freeze with each of the three major credit-reporting agencies. A freeze can help prevent new accounts from being opened in your name until you lift it.

If a notice says a driver’s license, identification card or passport may have been exposed, contact the agency that issued the document. The South Carolina Department of Consumer Affairs Identity Theft Unit also offers guidance at 800-922-1594.

The statewide total shows the volume of reported exposure, but it does not establish that every listed resident suffered identity theft or financial loss. The individual notice remains the best source for what information was involved, what protections are offered and what deadlines apply.

Sources

• South Carolina Department of Consumer Affairs: First-half 2026 breach report
• Spectrum News: SCDCA reports decline in security breaches

The related court papers were filed June 29, 2026. The FTC also asked the court to enter a stipulated order that, if approved, would include notice and outreach so eligible victims learn how to request the records and so some people who previously requested records can be reached with instructions.

What the FTC alleges Amazon did wrong under FCRA Section 609(e)

In its complaint, the FTC alleges Amazon refused to provide some covered records and, in other instances, failed to respond within the FCRA’s required 30-day timeframe. The FTC also alleges Amazon sometimes pointed to security or privacy reasons to deny requests—claims the FTC argues are not permitted under the Section 609(e) framework.

The key compliance deadline: 30 days

A major issue in the case is timing. The FTC’s complaint alleges Amazon did not provide application and business transaction records not later than 30 days after eligible identity-theft victims requested them.

What the proposed stipulated order would require (beyond payment)

According to the FTC’s proposed order documents, Amazon would have to:

• Provide website notice describing how identity-theft victims can request covered records
• Send records within 30 days after receiving qualifying requests (subject to the Section 609(e) process and verification requirements described in the court papers)
• Do outreach aimed at reaching eligible victims and certain people who previously requested records but did not receive them

As always in FTC enforcement announcements, readers should treat this as resolution of allegations through a proposed stipulated order—until the court enters an order on the terms described in the case packet.

Who’s affected—and what to watch next

The practical impact is on identity-theft victims trying to obtain application and business transaction records tied to fraudulent activity. The FTC’s focus is not just on broad privacy policy—it’s on whether companies follow the legally required records-request timing rules.

What to watch next:

• Whether and when the court enters the stipulated order on the FTC’s proposed terms
• Whether the FTC uses this case as a template for similar enforcement around Section 609(e) response-handling

If you are an identity-theft victim pursuing records under Section 609(e), a practical takeaway is to keep documentation of your request and dates—because this case underscores that federal regulators treat the 30-day response requirement as a core compliance obligation.

Sources

• FTC press release (June 30, 2026): Amazon to pay $2.25 million over alleged FCRA Section 609(e) violation