RM identified all individuals whose personal information had been accessed during the breach, made notifications to them as required under state laws, and offered them free credit monitoring services.