According to Washington law, data breaches are only reported if they potentially affect 500 people or more, and Ferguson said his office has received 51 such notifications for fiscal year 2018.