; (2) the Federal Bureau of Investigation; (3) the Secret Service; (4) for common carriers, the Federal Communications Commission; (5) for entities that provide a consumer financial product or service (as defined in section 1002 of the Consumer Financial Protection Act of 2010 ( 12 U.S.C. 5481 )), the Bureau of Consumer Financial Protection; and (6) the attorney general of each State in which the personal information of a resident or residents of the State was, or is reasonably believed to have been, acquired or accessed by an unauthorized person, or used for an unauthorized purpose. (e) Other obligations following breach (1) In general A covered entity required to provide notification under subsection (a) shall, upon request of an individual whose personal information was included in the breach of security, provide or arrange for the provision of, to each such individual and at no cost to such individual— (A) at the option of such individual, either— (i) consumer credit reports from all of the major consumer reporting agencies beginning not later than 60 days following the individual’s request and continuing on a quarterly basis for a period of not less than 10 years thereafter; or (ii) a credit monitoring or other service that— (I) enables consumers to detect the misuse of their personal information, beginning not later than 60 days following the individual’s request and continuing for a period of not less than 10 years thereafter; and (II) includes monitoring of the individual’s credit file at all of the major consumer reporting agencies