Most people learn about a data breach the same way: an email arrives, usually weeks or months after the fact, saying that some of their information may have been exposed. By then the story has been shaped by lawyers and communications teams. Data breach disclosure of this kind rarely mentions how long attackers were inside or whether anyone argued internally about how much to tell the public. Occasionally, an insider decides the account is incomplete, and becomes a whistleblower.
The data breach disclosure duty
Rules on data breach disclosure differ widely by place and industry. In many jurisdictions, companies must notify affected individuals and a regulator when personal data is compromised, within a certain period after discovery. Publicly traded companies often face additional rules about informing investors of incidents that could matter to the business. Contractors who work with governments can have extra obligations to report to their customer agencies.
The details of data breach disclosure hinge on definitions. What counts as personal data, what level of likelihood of harm triggers a notice, and when a company is deemed to have discovered a breach are all points where interpretation matters. Two companies in similar situations can reach different conclusions about whether they had to disclose.
Governments are also debating how far online rules should reach, from privacy to content and age checks, a wider context laid out in this explainer on online content rules and age checks. Breach rules are one strand of that debate, and they tend to tighten after high-profile incidents. For a general definition of the problem, see the article on a data breach.
Why data breach disclosure gets delayed
Hiding a breach is rarely a single decision by a single villain. More often it comes from small steps. An incident is classified as low severity. A lawyer concludes the threshold for notice was not met. A manager hopes the investigation will show less damage than feared. Nobody wants to be the person who triggers a crisis, and the cost of reporting is immediate while the cost of silence is delayed.
Complexity helps concealment. Large organizations run thousands of systems, and logs may be incomplete. Determining which records were accessed can take weeks, giving room for debate about when the clock starts.
The role of insiders
Employees in security, compliance and engineering teams often see the facts first. When they believe the company’s public statements are misleading, they have options: raise it internally, go to a regulator, or speak to the press. Many countries have laws that protect people who report certain kinds of wrongdoing, and some regulators run programs that allow tips to be submitted confidentially and, in specific areas, rewarded.
Whistleblowing carries real personal risk. Careers can suffer, and legal battles are slow. Claims made by an individual are allegations until investigated, and an organization has the right to respond and contest them. It is wise for readers to keep this distinction in mind and wait for findings from courts or regulators before treating any claim as established fact.
What an honest breach notice includes
- What happened, in plain language, and when it was discovered.
- What kinds of information were involved.
- What the company is doing in response.
- What you can do to protect yourself.
- A contact point for questions.
Be skeptical of notices that are vague about the type of data, describe the event as an isolated technical issue without detail, or arrive long after the incident. Good data breach disclosure names the date, the data involved and the fix, and gives you a person to contact. Anything less deserves follow-up questions.
Protecting yourself
- Change the password for the affected service and any other account that reused it.
- Turn on multi-factor authentication, preferring an authenticator app or security key over text messages.
- Watch bank and card statements, and consider a credit freeze if identifiers like national ID numbers were exposed.
- Be alert to phishing that uses details from the breach to sound convincing.
- Use a password manager so that each account has a unique password.
If your information turns up online, act quickly. The steps in this checklist for when customer data is posted online are a good place to start. Good data breach disclosure from a company should make those steps easier, not harder, by telling you exactly which fields were exposed and when.
What organizations should do about data breach disclosure
Companies that want to avoid a trust crisis should treat data breach disclosure as something to rehearse, and prepare before an incident: define who decides on disclosure, practice the response, and set criteria for notification that don’t depend on hoping the numbers come out small. Give employees a safe internal channel to raise concerns, and respond to it seriously. When people feel that the only way to be heard is outside, the damage to the organization is usually bigger than what an honest disclosure would have caused.
For customers and for the rest of us, the useful habit is to treat every breach statement as a first draft. Details tend to emerge over time, and the pattern of timely, specific communication, or its absence, tells you how seriously a company takes the data it holds.
Image: Çağatay Zavazar / Wikimedia Commons, CC BY-SA 4.0.
