I thought the same thing. WA's insurance commissioner doesn't sound happy about it either: http://blog.seattlepi.com/boomerconsumer/2015/03/17/insurance-commis

I thought the same thing. WA's insurance commissioner doesn't sound happy about it either: http://blog.seattlepi.com/boomerconsumer/2015/03/17/insurance-commissioner-offers-comments-on-premera-cyberattack/ http://blog.seattlepi.com/boomerconsumer/2015/03/17/insuranc... I called to ask about it, and was told that they were following the recommendations of Mandiant and the FBI; that they may put consumers at more risk if they announced prior to remediating their systems. It's an interesting point of distinction, as Washington state law requires disclosure "in the most expedient time possible ... The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation." http://apps.leg.wa.gov/rcw/default.aspx?cite=19.255.010 http://apps.leg.wa.gov/rcw/default.aspx?cite=19.255.010 Perhaps the call center scripts weren't nailed down yet - but they sure didn't mention an ongoing investigation as the reason for the delay.