Forty-six states require organizations to notify users when personally identifiable information has been exposed or when the organization's data security measures have been breached. This article describes a qualitative document analysis of 13 data breach notification templates from state and federal agencies. The results confirm much of the typical advice for negative messages, but they suggest that the direct pattern may be an effective way to inform users as required by law, to overcome optimism bias, and to overcome rational ignorance. When a buffer is used, writers should not be afraid to refer to the bad news.