Comment by miksik

> In the EU under GDPR you have to disclose within 48h

72h actually, but yes, data protection and breaches to sensitive personal information is taken very seriously in the European Union and its legislation.