My next question might seem like a trap, but I have to ask it anyway.
Let's look at things from the other way around. If Cascades were to be the victim of an outside attack on its data, would it be obligated to report that to someone, somewhere, in some way?