Comment Why the hell not, indeed. (Score 1) 250
Under various state laws, companies that hold personal private information have a responsibility to notify people when that information is no longer in their control.
Some are statutory periods of time, like 60 days. Others are more nebulous. ("As soon as possible reasonably practicable.")
The longer they wait to report, the more liable to make themselves under the laws.