If the ransomware attack doesn't exfiltrate any data I wouldn't think you'd have to disclose it. For this case, isn't it impossible to prove that the hackers di

If the ransomware attack doesn't exfiltrate any data I wouldn't think you'd have to disclose it. For this case, isn't it impossible to prove that the hackers didn't keep this data and sell it? Even if the hackers were fully cooperative with Uber, there's no guaranteeing that. In that case, I would think you'd have to notify the public.