Data theft, breach discovery, and breach disclosure happen on different dates. Theft is the attack, discovery starts the legal countdown, and disclosure is the public notice.
A breach notice lists a discovery or notification date, not the day thieves first entered. That gap decides when your information was exposed and when your protections begin. Check all three dates before you act.
Table of Contents
- Why does theft come long before discovery?
- What starts the HIPAA 60-day clock?
- How fast must companies notify under GDPR and California law?
- When must public companies disclose a hack?
- How should you read a breach notice?
Why does theft come long before discovery?
Attackers often remain inside systems for months before anyone notices. According to IBM Newsroom, global breaches averaged 258 days to identify plus contain in 2024, down from 277 days in 2023, in IBM's 2024 breach report. The intrusion date therefore long precedes the discovery date. Yahoo shows the extreme.
A federal court opinion summarized in the In re Yahoo! litigation describes August 2013 theft affecting about three billion accounts, disclosed in December 2016. Its separate late-2014 breach of 500 million accounts was disclosed in September 2016. The lesson is simple. Do not treat a disclosure date as the start of exposure. Assume misuse could have begun near the intrusion window.
What starts the HIPAA 60-day clock?
For health data, discovery controls the deadline. The HHS Office for Civil Rights says a covered entity must notify each affected individual without unreasonable delay and within 60 calendar days after discovering a breach of unsecured protected health information, in HHS breach notification guidance. Discovery means the first day anyone in the organization knew or should have known. The clock does not wait for forensics to finish.
A Crowell & Moring client alert on HHS enforcement describes an investigation after a 110-day delay, nearly double the deadline. If you receive a HIPAA notice, look for the discovery date first. A notice arriving near day 60 can still be timely. A later arrival deserves questions and documentation.
How fast must companies notify under GDPR and California law?
European law moves faster for regulators. Under GDPR Article 33, a controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a breach posing risk, according to the GDPR Article 33 text via the GDPR Regulation portal. That notice goes to the authority, not always to every victim. California sets a clear consumer deadline.
Effective January 1, 2026, California requires consumer notice within 30 calendar days of discovery, according to Pillsbury analysis of California law. When more than 500 residents are affected, the business must notify the Attorney General within 15 days after consumer notice. These rules limit delay but do not erase the theft-discovery gap. A fast notice can still describe an old intrusion.
When must public companies disclose a hack?
Public companies follow a two-step rule. The SEC Final Rules Fact Sheet says companies must determine materiality without unreasonable delay after discovery, then file Form 8-K Item 1.05 generally within four business days of that determination, in the SEC Final Rules Fact Sheet. Material means important to a reasonable investor. Discovery and disclosure are separated by design.
A Keating Muething & Klekamp analysis of the SEC final rule notes the four-day clock runs from the materiality determination, not from first discovery of the intrusion. Investigation and board review can sit between those dates. For readers, the filing date is not the hack date. Read the 8-K for the discovery window, scope of systems, and whether customer data was involved.
How should you read a breach notice?
Focus on action, not headlines. Use the dates to set priorities.
The discovery date starts most legal clocks, while the theft window measures your exposure. Keep both when you call the company, insurer, or doctor.
- Note theft or intrusion window, discovery date, and mailing or filing date.
- Replace passwords and enable two-factor on exposed accounts first.
- Place a fraud alert or freeze if Social Security, health, or financial identifiers were taken.
- Save the letter and track deadlines for credit monitoring or claims.
You Might Also Like
- Data Breach Confirmed vs. Data Published: Why the Distinction Matters
- Water Company Data Breaches: Why an Old Customer Account Can Still Matter
- Southern Water Data Breach: What to Ask if You Never Received a Letter