; and (B) from which the individual may learn what types of sensitive personally identifiable information the business entity maintained about that individual. (3) The toll-free contact telephone numbers and addresses for the major credit reporting agencies and the Commission. (4) The name of the business entity that has a direct business relationship with the individual. (5) Notwithstanding section 10, any information regarding victim protection assistance required by the State in which the individual resides. 6. Coordination of notification with credit reporting agencies (a) Requirement To notify credit reporting agencies If a business entity is required to notify more than 5,000 individuals under section 2, the business entity shall also notify each consumer reporting agency that compiles and maintains files on consumers on a nationwide basis (as defined in section 603(p) of the Fair Credit Reporting Act ( 15 U.S.C. 1681a(p) )) of the timing and distribution of the notifications. Such notification shall be given to the consumer credit reporting agencies without unreasonable delay and, if it will not delay notification to the affected individuals, prior to the distribution of notifications to the affected individuals. (b) Reasonable delay Reasonable delay under subsection (a) shall not exceed 30 days following the discovery of a security breach, except as provided in subsection (c) or (d) of section 2 (in which case, before the extended deadline), or unless the business entity providing notification can demonstrate to the Commission that additional time is reasonably necessary to determine the scope of the security breach, prevent further disclosures, conduct the risk assessment, restore the reasonable integrity of the data system, and provide notice to the breach notification entity. If the Commission determines that additional time is necessary, the Commission may extend the time period for notification for additional periods of up to 30 days each. Any such extension shall be provided in writing. 7.