1,000 Data Breaches Later, the Disclosure Lag is Worse Than Ever

Back to Devoured - June 09, 2026

DEVOURED

1,000 Data Breaches Later, the Disclosure Lag is Worse Than Ever

Tech securitydata Troy Hunt

Troy Hunt's analysis of 1,000 data breaches shows that the time between a breach occurring and public notification is increasing, despite regulatory pressure.

What: Troy Hunt analyzed data from 1,000 breaches and found that companies are increasingly delaying the public disclosure of security incidents to shield shareholder interests, despite the technical ability to identify compromised accounts quickly.

Why it matters: The discrepancy between the speed at which attackers exfiltrate data and the speed at which firms notify victims confirms that disclosure policy is driven by legal risk management rather than user safety.

Deep dive

Data disclosure timelines have expanded significantly over the last decade.
Companies often prioritize mitigating stock market impact over timely notification.
The existence of a 'breach' is often known by internal teams for months before public disclosure occurs.
Regulatory requirements are insufficient to curb the incentive to keep users in the dark.
Breach data often reaches services like 'Have I Been Pwned' long before official communications are released.

Decoder

Disclosure Lag: The time delta between a company detecting a security compromise and informing its users or regulators of the incident.

Original article

Companies would rather protect shareholder value than ensure customers are informed about data breaches.

Explore all 42 articles in today's digest