If they don't disclose in time, or are found to have been able to have prevented the breach, they could face some serious fines in the EU under GDPR. At odds w

If they don't disclose in time, or are found to have been able to have prevented the breach, they could face some serious fines in the EU under GDPR. At odds with the Armageddon-like comments in the Twitter thread, this is still to be worked out. It is not a certainty.