The State of Data Breaches

This commentary critiques the current state of breach disclosure and notification, highlighting how organizations often ignore or delay notifying affected individuals, prioritize legal and reputational risk management over transparency, and exploit regulatory gaps that require notifying regulators but not victims. It discusses the practical barriers to responsible disclosure (lack of security.txt, spammed channels, hostile responses), the negative influence of class actions on cooperation, and the growing complexity of third-party dependencies, concluding with calls for mandatory victim notification, protections against frivolous lawsuits, and accountability for deliberate concealment.