A company confirms that attackers stole an unencrypted database of customer names, addresses, and government identification numbers. Applicable privacy law requires breaches of this type of data to be reported. Which action BEST meets the organization's obligations?
Select an answer to reveal the explanation.
Short Explanation
When the law says you must report, containment doesn't make that duty disappear. You notify the people whose data walked out the door and the regulators, on the clock the law sets. Waiting for the final report is the trap - those deadlines don't wait for your paperwork.
Full Explanation
Notification and external reporting is a distinct incident response activity. When personal data covered by breach notification law is confirmed stolen, the organization must notify the parties the law specifies, commonly affected individuals and one or more regulators, and sometimes law enforcement, within the timeframe the law defines. Counsel typically guides content and timing, and communications explain what data was involved and what individuals can do to protect themselves. Notifying only the IT team ignores the external obligation; containment limits further harm but does not erase the fact that data already left the organization. Declining external notification because outside attackers stole the data inverts the logic; theft by an external party is precisely the kind of breach these laws address. Waiting until the post-incident report is finalized months later would almost certainly miss statutory deadlines, which typically run from discovery of the breach, not from completion of internal documentation. Exam caveat: notification requirements vary by jurisdiction and data type, so plans list the regulators and deadlines that apply rather than assuming one universal rule. Operational check: confirm the incident record captures the discovery date, the data types affected, the applicable notification requirements, and evidence of when each required party was notified.