; and (ii) the e-mail notice does not request, or contain a hypertext link to a request, that the consumer provide personal information in response to the notice. (2) Media and website notice In the event notice is required to more than 5,000 individuals in 1 State and individual notice is not feasible due to lack of sufficient contact information for the individuals required to be notified, a covered entity shall— (A) provide notice to the major media outlets serving the State or jurisdiction of the individuals believed to be affected; and (B) place notice in a clear and conspicuous place on the website of the covered entity if the covered entity operates a website. 214. Content of notification (a) In general Regardless of the method by which notice is provided to individuals under section 213, such notice shall include, to the extent possible— (1) a general description of the incident and the date or estimated date of the security breach and the date range during which the sensitive personally identifiable information was compromised; (2) a description of the categories of sensitive personally identifiable information that was, or is reasonably believed to have been, accessed or acquired by an unauthorized person; (3) the acts the covered entity, or the agent of the covered entity, has taken to protect sensitive personally identifiable information from further security breach; (4) a toll-free number— (A) that the individual may use to contact the covered entity, or the agent of the covered entity; and (B) from which the individual may learn what types of sensitive personally identifiable information the covered entity maintained about that individual