Hacker News Reader

The actual issue at (this) hand is the lack of reporting the breach, and the rule is not that you have to disclose "once you have your ducks in a row." You have to disclose soon after determining that it's material. Still a little squishy, but not quite as squishy as ducks.

View on HN

The challenge I guess is determining what is considered material.

Companies find it challenging enough in complex breaches whether a breach has actually occurred within a short period of time. Let alone identify that a breach has occurred AND it was also material.

Well usually ransomware attacks make you pretty aware of the severity in very obvious ways, per the "ransom" part.

When it comes down to brass tax, companies will pull any lever they can they avoid negligence when it comes to penalties. If there is any ambiguity on what is considered Material, they're going to try that.

Furthermore, if you have identified a breach in your systems, you may not have even received a ransom notice at that point.

Materiality in other aspects in relation to SEC reporting has a definition, because there needs to be a consistent understanding of where to draw the line.

Exactly, someone is lying big here.

Reply on news.ycombinator.com