; and (B) provides notification to affected individuals after a security breach that has resulted in fraud or unauthorized transactions. (2) Limitation The exemption in paragraph (1) does not apply if the information subject to the security breach includes the individual’s first and last name or any other type of sensitive personally identifiable information other than a credit card number or credit card security code. 4. Methods of notification A business entity shall be in compliance with the requirements of this section if, with respect to the method of notification as required under section 2, the following requirements are met: (1) Individual notification Notification to an individual is by one of the following means: (A) Written notification to the last known home mailing address of the individual in the records of the business entity. (B) Telephone notification to the individual personally. (C) E-mail notification, if the individual has consented to receive such notification and the notification is consistent with the provisions permitting electronic transmission of notifications under section 101 of the Electronic Signatures in Global and National Commerce Act ( 15 U.S.C. 7001 ). (2) Media notification If the number of residents of a State whose sensitive personally identifiable information was, or is reasonably believed to have been, accessed or acquired by an unauthorized person exceeds 5,000, notification is provided to media reasonably calculated to reach such individuals, such as major media outlets serving a State or jurisdiction. 5. Content of notification The notification provided to individuals required by section 2 shall include, to the extent possible, the following: (1) A description of the categories of sensitive personally identifiable information that was, or is reasonably believed to have been, accessed or acquired by an unauthorized person. (2) A toll-free number— (A) that the individual may use to contact the business entity, or the agent of the business entity