; (IV) the toll-free contact telephone numbers and addresses for the major credit reporting agencies; and (V) a toll-free telephone number and internet website address for the Commission whereby the individual may obtain information regarding identity theft. (ii) Direct business relationship Any notification provided under this subsection shall identify the covered entity that has a direct business relationship with the individual. (E) Substitute notification Criteria for determining circumstances under which substitute notification may be provided in lieu of direct notification required by subparagraph (A), including criteria for determining if notification under subparagraph (A) is not feasible due to excessive costs to the covered entity required to provide such notification relative to the resources of such covered entity and the form and content of substitute notification. (5) Notification for law enforcement and other purposes A covered entity to, as expeditiously as practicable and without unreasonable delay, but not later than 7 days following the discovery of a breach of security, provide notification of the breach to— (A) the Commission; (B) the Federal Bureau of Investigation; (C) the Secret Service; (D) for common carriers, the Federal Communications Commission; (E) for entities that provide a consumer financial product or service (as defined in section 1002 of the Consumer Financial Protection Act of 2010 ( 12 U.S.C. 5481 )), the Consumer Financial Protection Bureau