Dissent Doe :cupofcoffee:<p><span class="h-card" translate="no"><a href="https://infosec.exchange/@amvinfe" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>amvinfe</span></a></span> <span class="h-card" translate="no"><a href="https://noc.social/@AAKL" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>AAKL</span></a></span> <span class="h-card" translate="no"><a href="https://infosec.exchange/@brett" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>brett</span></a></span> <span class="h-card" translate="no"><a href="https://ioc.exchange/@jgreig" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>jgreig</span></a></span> </p><p>It seems pretty clear from what BianLian has posted that there were TWO unrelated attacks, but Akumin has only disclosed the first attack -- even though it has issued updates since the time of the second attack.</p><p>That said: if the second attack was in November, as it allegedly was, then Akumin is still within a 60-day window from discovery to when it must notify HHS and affected patients. </p><p>But if an entity issues a press release or update that discloses one data breach but is silent on the fact that there was a second breach, too, resulting in the theft of patient data, is that a deceptive or unfair act under Section 5 of the FTC Act?</p><p><a href="https://infosec.exchange/tags/transparency" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>transparency</span></a> <a href="https://infosec.exchange/tags/incidentreponse" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>incidentreponse</span></a> <a href="https://infosec.exchange/tags/extortion" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>extortion</span></a> <a href="https://infosec.exchange/tags/healthsec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>healthsec</span></a> <a href="https://infosec.exchange/tags/databreach" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>databreach</span></a></p>