> How do you know nobody broke in? This applies to almost every security-related bug ever, so the analogy holds. If you run a company with PII in your mysql,

> How do you know nobody broke in? This applies to almost every security-related bug ever, so the analogy holds. If you run a company with PII in your mysql, and mysql has a bug (not uncommon), are you now required to tell all your customers that someone may have hacked your database, and then erased the logs? What if you irresponsibly didn't have a firewall (or your firewall allowed connections from business partners, to some non-PII tables)? It's possible that between the time the bug was introduced (or made public), and the time you patched, that someone at your business partner stole personal information, and it's not feasible for you to in all cases know if this happened. No matter how good you are, it's not feasible in the real world. > And if you're responsible for storing personal data for millions of people in your home, and you left the keys in the door for a few hours, and you can't prove that nobody broke in, then maybe you should let people know that there's a chance their data has been compromised. Maybe I should. And in this case, I did. But not right away. But it's a long way from "maybe you should" to "you MUST (by power of law) IMMEDIATELY". Read up on some "keys left in the door" scenarios about nuclear weapons security. We tend to not find out about those right away either.