Approximately 17 states as of 2005 have enacted statutes that require state agencies and companies to disclose security breaches that involve the potential release of personal information of consumers. In some instances, these breaches have compromised personal information of hundreds of thousands of individuals. These statutes provide notification to those who potentially could be the victims of identity theft as a result of such a breach.