[cj]

Probably legal reasons. Usually doesn’t make business sense to declare and publicly announce a breach until you do some internal investigating to understand the scope/impact (not defending them, it’s just reality.. also their cyber insurance company would get pissed if they did anything without their approval during a possible breach, things take time)

Probably also some internal debate whether this should be considered a breach or not and whether it’s worth the cost of announcing it vs. the risk of not announcing it

[jacquesm]

There are legal (GDPR, Art. 34) requirements to publish a breach if it hits EU citizens and the bar for publication is met.

[remus]

This is true, but as the parent mentioned you also need to understand the nature of the breach first. Giving people accurate information is as important as giving them timely information.