Hacked companies caught in maze of notification requirements

With more businesses, governments and organisations succumbing to cyberattacks, the lack of a clear and effective reporting standard for threats and breaches has taken on new urgency. — Bloomberg

Last summer, Katherine “Kitty” Green received some disturbing news about the computer network at Florida Gulf Coast University, where she oversees a foundation for private donors. An outside data provider warned it had detected that hackers sneaked into the university’s systems and might have made off with sensitive personal information of its benefactors.

Six months later, FGCU sent out notices to 5,498 financial supporters, offering free credit-monitoring and a hot line to call for more information. One reason it took so long is that, after consulting with technical and legal experts, the university concluded that under local laws, it would have to file different notifications in 16 different states.