What obligation would, say, the department have to notify the public generally about potential breaches or risks to their own...if it's from one particular third party or some kind of similar instance? In this case, the public was not notified at all. I acknowledge that the individuals, some individuals, were contacted, but the general public was not made aware either.
On December 5th, 2024. See this statement in context.