party involved in the case of a notification required under subsection (a)(2)(A)). (2) Expedited notification to FTC and FBI Notwithstanding paragraph (1), if there are 500 or more individuals to which a covered entity is required to provide notification of a breach under subsection (a)(1)(B), the covered entity shall notify the Commission and the Federal Bureau of Investigation of such breach as required under subsection (a)(1)(A) not later than 48 hours after the discovery of such breach by the covered entity. (3) Expedited notification by third parties Notwithstanding paragraph (1), a third party subject to subsection (a)(2)(B) with respect to a breach shall make the notifications required by such subsection not later than 48 hours after discovery of the breach by the third party. (4) Burden of proof The covered entity involved (or the third party involved in the case of a notification required under subsection (a)(2)) shall have the burden of demonstrating that all notifications were made as required under subsection (a), including evidence demonstrating the necessity of any delay. (5) Breaches treated as discovered For purposes of this section, a breach shall be treated as discovered by a covered entity or, in the case of a breach described in subsection (a)(2), by a third party, as of the first day on which such breach is known to such covered entity or third party, respectively (including any person, other than the individual committing the breach, that is an employee, officer, or other agent of such covered entity or third party, respectively) or should reasonably have been known to such covered entity or third party (or person) to have occurred. (c) Methods of individual notification Notification required to be provided to an individual under subsection (a)(1)(B) with respect to a breach shall be provided in the following form: (1) Written notification by first-class mail to the individual (or the next of kin of the individual if the individual is deceased) at the last known address of the individual or