Disclosure of an attack, if that attack results in exfiltration, is required by law. If you cover up that, and don't disclose, someone is going to be in legal t

Disclosure of an attack, if that attack results in exfiltration, is required by law. If you cover up that, and don't disclose, someone is going to be in legal trouble. If you've had an attack, you disclose, and what you discuss in terms of the protections you had in place, and the actions you're going to take afterwards weren't completely accurate, that's more of a grey area.