The Data Breach Disclosure Conundrum

This article argues that organizations should proactively disclose data breaches to affected individuals, highlighting regulatory carveouts (e.g., GDPR’s risk-based thresholds) and illustrating the pitfalls of non-disclosure through cases like Deezer. It contends that withholding notification primarily protects brands—not customers—creates an information vacuum filled by attackers and misinformation, and can escalate backlash when the truth emerges. The author outlines practical harms even from seemingly benign data (e.g., email-only breaches enabling phishing and credential stuffing), emphasizes transparency to set the narrative, and urges prompt, victim-centered communication as a matter of decency and best practice.