; (v) instructions how an individual can request consumer credit reports under subsection (e)(1); (vi) a telephone number, that an individual can use at no cost to the individual, and an address to contact each major credit reporting agency; and (vii) a telephone number, that an individual can use at no cost to the individual, and an Internet Web site address to obtain information regarding identity theft from the Commission. (2) Substitute notification (A) Circumstances giving rise to substitute notification A covered entity required to provide notification under subsection (a)(1) may provide substitute notification instead of direct notification under paragraph (1)— (i) if direct notification is not feasible due to a lack of sufficient contact information for the individual required to be notified; or (ii) if the covered entity owns or possesses data in electronic form containing personal information of fewer than 10,000 individuals and direct notification is not feasible due to excessive cost to the covered entity required to provide such notification relative to the resources of such covered entity, as determined in accordance with the regulations issued by the Commission under paragraph (3)(A). (B) Method of substitute notification Substitute notification under this paragraph shall include— (i) conspicuous and clearly identified notification by e-mail to the extent the covered entity has an e-mail address for an individual who is entitled to notification under subsection (a)(1); (ii) conspicuous and clearly identified notification on the Internet Web site of the covered entity if the covered entity maintains an Internet Web site; and (iii) notification to print and to broadcast media, including major media in metropolitan and rural areas where the individuals whose personal information was acquired reside. (C) Content of substitute notification Each method of substitute notification under this paragraph shall include— (i) the date, estimated date, or estimated date range of the breach of security