; and (3) notify the Bureau. (b) Special notification requirements (1) Third-party agents In the event of a breach of security by any third-party entity that has been contracted to maintain or process data in electronic form containing personal information on behalf of any other person who owns or possesses such data, such third-party entity shall be required to notify such person of the breach of security. Upon receiving such notification from such third party, such person shall provide the notification required under subsection (a). (2) Service providers If a service provider becomes aware of a breach of security of data in electronic form containing personal information that is owned or possessed by another person that connects to or uses a system or network provided by the service provider for the purpose of transmitting, routing, or providing intermediate or transient storage of such data, such service provider shall be required to notify of such a breach of security only the person who initiated such connection, transmission, routing, or storage if such person can be reasonably identified. Upon receiving such notification from a service provider, such person shall provide the notification required under subsection (a). (3) Coordination of notification with consumer reporting agencies If a person is required to provide notification to more than 1,000 individuals under subsection (a)(1), the person shall also notify the major consumer reporting agencies of the timing and distribution of the notices. Such notice shall be given to the consumer reporting agencies without unreasonable delay and, if it will not delay notice to the affected individuals, prior to the distribution of notices to the affected individuals. (c) Timeliness of notification (1) In general Unless subject to a delay authorized under paragraph (2), a notification required under subsection (a) shall be made not later than 30 days following the discovery of a breach of security, unless the person providing notice can show that providing notice