1k Data Breaches Later, the Disclosure Lag Is Worse

Have I Been Pwned reached its 1,000th recorded data breach, coinciding with a troubling trend of increasingly long disclosure delays between when companies discover breaches and when they notify victims. The article highlights cases like Carnival Corporation, which waited 43 days to disclose a breach affecting 8.7 million records despite the data being publicly available for weeks, and Zara with a 45-day delay, demonstrating that companies often delay notifications under the guise of needing time to assess the breach scope rather than issuing early warnings with available information like email addresses.