Maybe its already been answered in the comments, but I cant seem to find it but isnt it required by law to notify the users ? At least for GDPR there is a requ

Maybe its already been answered in the comments, but I cant seem to find it but isnt it required by law to notify the users ? At least for GDPR there is a requirement : > A controller is obliged to notify the DPC of any personal data breach that has occurred, unless they are able to demonstrate that the personal data breach is 'unlikely to result in a risk to the rights and freedoms of natural persons'.