; and (ii) the method of notification selected under clause (i) can reasonably be expected to reach the intended individual. (B) Content of direct notification Each method of notification under subparagraph (A) shall include the following: (i) The date, estimated date, or estimated date range of the breach of security. (ii) A description of the personally identifiable information that was or is reasonably believed to have been acquired or accessed as a result of the breach of security. (iii) A telephone number that an individual can use at no cost to the individual to contact the covered entity to inquire about the breach of security or the information the covered entity maintained about that individual. (iv) Notice that the individual may be entitled to consumer credit reports under subsection (e)(1). (v) Instructions how an individual can request consumer credit reports under subsection (e)(1). (vi) A telephone number, that an individual can use at no cost to the individual, and an address to contact each major credit reporting agency. (vii) A telephone number, that an individual can use at no cost to the individual, and an Internet website address to obtain information regarding identity theft from the Commission. (2) Substitute notification (A) Circumstances giving rise to substitute notification A covered entity required to provide notification to individuals under subsection (a)(1) may provide notification under this paragraph instead of paragraph (1) of this subsection if— (i) notification under paragraph (1) is not feasible due to lack of sufficient contact information for the individual required to be notified