; and (ii) with respect to the covered breach, consult with the relevant Federal law enforcement agencies and intelligence agencies, as appropriate. (2) Notification to affected consumers and the public (A) In general Except as provided in paragraph (3), on an expeditious and practical timeline, as determined appropriate by the Commission, a covered consumer reporting agency that is subject to a covered breach shall— (i) submit to each affected consumer with respect to whom the covered consumer reporting agency holds a piece of personally identifying information a notification regarding the covered breach that complies with subparagraph (B); and (ii) publish on the internet website of the covered consumer reporting agency a notice that contains a statement of— (I) the information described in clauses (i) and (ii) of subparagraph (B) and subclauses (I) and (II) of clause (iii) of that subparagraph; and (II) the steps that the covered consumer reporting agency is taking to notify the affected consumers described in clause (i) regarding the covered breach. (B) Notification to affected consumers In a notification to affected consumers under subparagraph (A)(i), the covered consumer reporting agency submitting the notification shall include a statement of— (i) the fact that the covered breach occurred; (ii) the approximate date on which the covered breach occurred; and (iii) with respect to the covered breach— (I) the number of affected consumers; (II) the measures that the covered consumer reporting agency is taking to remedy the covered breach