GDPR requires disclosing to the supervisory authority if user data was breached. Though this hack was before GDPR. https://gdpr-info.eu/art-33-gdpr/ https://gd

GDPR requires disclosing to the supervisory authority if user data was breached. Though this hack was before GDPR. https://gdpr-info.eu/art-33-gdpr/ https://gdpr-info.eu/art-33-gdpr/ edit: Also California requires notifying the residents directly and if over 500 residents were effected also the attorney general https://oag.ca.gov/privacy/databreach/reporting https://oag.ca.gov/privacy/databreach/reporting