; and (2) the Commission, unless the covered entity has notified the designated entity under section 4. (b) Special notification requirements (1) Third-party entities In the event of a breach of security of a system maintained by a third-party entity that has been contracted to maintain or process data in electronic form containing personal information on behalf of any other covered entity who owns or possesses such data, the third-party entity shall notify the covered entity of the breach of security. Upon receiving notification from the third-party entity, such covered entity shall provide the notification required under subsection (a). (2) Coordination of notification with credit reporting agencies If a covered entity is required to provide notification to more than 5,000 individuals under subsection (a)(1), the covered entity also shall notify each major credit reporting agency of the timing and distribution of the notices, except when the only personal information that is the subject of the breach of security is the individual’s first name or initial and last name, or address, or phone number, in combination with a credit or debit card number, and any required security code. Such notice shall be given to each credit reporting agency without unreasonable delay and, if it will not delay notice to the affected individuals, prior to the distribution of notices to the affected individuals. (c) Timeliness of notification Notification under subsection (a) shall be made— (1) not later than 30 days after the date of discovery of a breach of security; or (2) as promptly as possible if the covered entity providing notice can show that providing notice within the timeframe under paragraph (1) is not feasible due to circumstances necessary— (A) to accurately identify affected consumers; (B) to prevent further breach or unauthorized disclosures