If a consumer credit reporting agency violates a security freeze by releasing a consumer's credit report or credit score, the consumer credit reporting agency shall notify the consumer within five business days after discovering or being notified of the release, and the information in the notice must include an identification of the information released and of the third party who received the information.