The 60-day limit
Notice to residents shall be made in the most expedient time possible and without unreasonable delay but not later than sixty days from the discovery of the breach. Sixty days is the ceiling, not the target. The clock runs from discovery, so the date a business first learns of the breach is worth recording carefully.
If notice is delayed past that period, the business provides the attorney general the reasons for the delay in writing within the sixty day notification period.