When communicating a security incident to customers, especially one that involves unauthorized access to their data, an official notification provides transparent, direct, and legally appropriate information. It is important these communications are clear, factual, and often they need to comply with data breach notification laws. The notification typically includes what happened, what information was involved, what the company has done to address the breach, and what actions customers can take to protect themselves. A blog post might not be formal or targeted enough, a tweet is too informal and limited in detail, and internal documentation is not intended for customers.