“US state law doesn’t set a deadline for reporting security breaches in the same way as the GDPR does, for example, so for those wondering what action USG will face for disclosing so late, the answer is probably none.”
The University System of Georgia caught the Cl0p MOVEit breach on May 31, 2023 and started telling the 800,000 victims on April 15, 2024. The letter lists full Social Security numbers, bank account numbers and tax documents. The victims get 12 months of Experian credit monitoring for data that never expires. “Without unreasonable delay” turned out to mean almost a year.