If it was a security breach, and any data was leaked, they have a responsibility to inform anyone affected. At least in California http://oag.ca.gov/ecrime/data

If it was a security breach, and any data was leaked, they have a responsibility to inform anyone affected. At least in California http://oag.ca.gov/ecrime/databreach/reporting http://oag.ca.gov/ecrime/databreach/reporting