I am not sure that a Cloudflare compromise would not rise to the level of a reportable event. In my experience/opinion "users' plaintext compromise" is certainl

I am not sure that a Cloudflare compromise would not rise to the level of a reportable event. In my experience/opinion "users' plaintext compromise" is certainly an instance of unauthorized access to customer information. I understand the whole framework here is risk-based so it is a matter of interpretation; but I do not want to be the person who has to explain to the nice folks from the OCC the intricacies of Cloudflare's implementation and why I deemed the compromise low risk. > An institution should notify its primary Federal regulator as soon > as it becomes aware of the unauthorized access to or misuse of > sensitive customer information or customer information systems. FDIC: Supervisory Insights https://www.fdic.gov/regulations/examinations/supervisory/insights/siwin06/article01_incident.html https://www.fdic.gov/regulations/examinations/supervisory/in...