; or (ii) the covered entity owns or possesses data in electronic form containing personally identifiable information of fewer than 10,000 individuals and direct notification is not feasible due to excessive cost to the covered entity required to provide such notification relative to the resources of such covered entity, as determined in accordance with the regulations issued by the Commission under paragraph (3)(A). (B) Method of substitute notification Notification under this paragraph shall include the following: (i) Conspicuous and clearly identified notification by e-mail to the extent the covered entity has an e-mail address for an individual who is entitled to notification under subsection (a)(1). (ii) Conspicuous and clearly identified notification on the Internet website of the covered entity if the covered entity maintains an Internet website. (iii) Notification to print and to broadcast media, including major media in metropolitan and rural areas where the individuals whose personally identifiable information was acquired or accessed reside. (C) Content of substitute notification Each method of notification under this paragraph shall include the following: (i) The date, estimated date, or estimated date range of the breach of security. (ii) A description of the types of personally identifiable information that were or are reasonably believed to have been acquired or accessed as a result of the breach of security. (iii) Notice that an individual may be entitled to consumer credit reports under subsection (e)(1). (iv) Instructions how an individual can request consumer credit reports under subsection (e)(1). (v) A telephone number that an individual can use at no cost to the individual to learn whether the individual's personally identifiable information is included in the breach of security. (vi) A telephone number, that an individual can use at no cost to the individual, and an address to contact each major credit reporting agency. (vii) A telephone number, that an individual can use at no cost to the