; (2) the Federal Bureau of Investigation; (3) the Secret Service; (4) for common carriers, the Federal Communications Commission; (5) the Consumer Financial Protection Bureau; and (6) the attorney general of each State in which the personal information of a resident or residents of the State was, or is reasonably believed to have been, acquired or accessed by an unauthorized person, or used for an unauthorized purpose. (e) Other obligations following breach (1) In general A covered entity required to provide notification under subsection (a) shall, upon request of an individual whose personal information was included in the breach of security, provide or arrange for the provision of, to each such individual and at no cost to such individual— (A) consumer credit reports from the major credit reporting agencies beginning not later than 60 days following the individual’s request and continuing on a quarterly basis for a period of 5 years thereafter