Yes, if there is a federal investigation you cannot conceal or refuse to disclose details. There isn't a clear answer on proactive reporting. Depending on the

Yes, if there is a federal investigation you cannot conceal or refuse to disclose details. There isn't a clear answer on proactive reporting. Depending on the type of business you have, what data you hold, the scale of the attack, etc. Some specific professions have mandatory reporting laws that may cover individuals that work for you. (see https://www.lw.com/thoughtLeadership/LW-ransomware-attacks-when-is-notification-required https://www.lw.com/thoughtLeadership/LW-ransomware-attacks-w... for a detailed answer) The generally accepted best practice is that every ransom attack be reported to the Cybersecurity and Infrastructure Security Agency. In the specific case of Uber, the incident involved scanned passports. The law is pretty clear that you have to report any compromise of passport data to the State Department.