; and (ii) the e-mail notice does not request, or contain a hypertext link to a request, that the consumer provide personal information in response to the notice. (2) Media, website, and social media notice In the event notice is required to more than 5,000 individuals in 1 State and individual notice is not feasible due to lack of sufficient contact information for the individuals required to be notified, a covered entity shall— (A) provide notice to the major media outlets serving the State or jurisdiction of the individuals believed to be affected; (B) place notice in a clear and conspicuous place on the website of the covered entity if the covered entity operates a website; and (C) place notice on each social media platform on which the covered entity maintains a social media presence, if any. 214. Content of notification (a) In general Regardless of the method by which notice is provided to individuals under section 213, such notice shall include, to the extent possible— (1) a general description of the incident and the date or estimated date of the security breach and the date range during which the sensitive personally identifiable information was compromised; (2) a description of the categories of sensitive personally identifiable information that was, or is reasonably believed to have been, accessed or acquired by an unauthorized person; (3) the acts the covered entity, or the agent of the covered entity, has taken to protect sensitive personally identifiable information from further security breach; (4) at the discretion of the covered entity, reasonable advice on steps the individual may take to protect himself or herself; (5) if applicable, an offer to provide appropriate identity theft prevention and mitigation services, as described in section 211(a)(2); (6) a toll-free number— (A) that the individual may use to contact the covered entity, or the agent of the covered entity