Did They Violate Breach Disclosure Laws?

Not sure I follow the logic here.  Is this a case of the old "gravity of the accusation" or simply perfect hindsight? 

A group of criminals broke into a variety of computer systems and stole a variety of protected data.  Your outrage stems from the assumption that these companies new of the intrusion and the consequences.  I don’‘t think this is reasonable.  If the US DoD is often caught unaware that such activity has happened, it is quite reasonable to assume that any less funded and resourced group would also be caught with their pants down. 

Also, the quote you’‘ve included notes thefts and attempted thefts.  What if these non-disclosing groups were in the latter category?

I’‘m really curious as to what legal exposure there is.  Many (not all, but many) state disclosure laws allow exactly this sort of risk assessment prior to notification when you are aware a breach has taken place.  But again, if you cannot determine the breach has taken place, what are you disclosing?

Looks like Forever 21 found some confirmation!

http://datalossdb.org/incidents/1159

(thanks quine)

@ds-

If nothing else, they should have disclosed after the indightments were handed down.

But I agree I might have jumped the gun and missed the "attempted" part. It will be itneresting to map the criminal evidence to who disclosed, as the case unfolds.

Interesting none-the-less…  But just had one comment to this line:

"And don’t forget, thanks to TJX seeing absolutely no effect on their business after the breach, we can pretty effectively kill off the reputation damage argument."

Sure, everyone in the security industry, and probably financial, are aware of what comes to mind first when you hear TJX.  But, I bet if you took a poll of *actual* TJX customers most would be clueless—hence, no change in BAU.

However, that’s not to say that disclosure wouldn’‘t affect business.  I do believe that if Google, Microsoft, Best Buy,  were to have been in the same situation there would be an interesting initial recourse followed by a "forget it, the convenience is easier than the alternative" attitude.

Just my $0.02 though…
—windexh8er

@lonervamp

I actually know of some cases where people didn’‘t disclose. My guess is, at best, half or so disclose when they know they’‘ve been breached, maybe 20% don’‘t disclose even when they have to, and the rest are just clueless.

In the other case I know of, only 1 of 3-4 organizations that were definitively breached notified. But truth is, we’‘ll never be able to accurately quantify this.

Unless we start hacking people and keeping track of the numbers.

You know… this reminds me of the old phrase we used to use when I was a kid-
  - "It’s only illegal if you get caught"
... roughly translated into today’s business climate it would sound like this:
  -"It’s only a legal problem is someone finds out about it and can prove it happened and we knew about it and did nothing" but even then, with today’s regulations and "loose" compliance guidelines open to interpretation by any half-decent legal staff… does anyone really care?

Since I currently live in the niche of web application security; everyone is "concerend" about application security but they’‘re only willing to spend or actually *do* the absolute bare-minimum their lawyers can’‘t get them out of in a court of law.  The "Court of Public Opinion" in the greater consumer market is deaf, dumb, and blind (not to mention ignorant and stupid)... which leads me to believe that as long as you can get away with it by "dodging" regulations and government mandates - you’‘ll be just fine.

How sad is that?

[...] are underreported. As shown in the TJX case, not every company performs a breach notification (TJX reported, other organizations did not). I [...]

Rich:  Careful reading of the indictments of the TJX data thieves show that the media, card issuers and Federal Trade Commission over-reacted to the TJX incident.  The TJX break-in was not as bad as we were led to believe. —Ben http://legal-beagle.typepad.com/wrights_legal_beagle/2008/08/credit-card-iss.html