The DXS International incident at 25-1214b was disclosed through a filing with the stock exchange on 18 December 2025, four days after discovery.
The Corpus Named This Route In September
At 25-0924b this desk added a fifth filter to the record-formation argument at 25-0502: whether the company is listed. Boyd Gaming’s employee-data incident reached the public record through a securities filing rather than through any data-protection route.
That file observed the filter introduces a wealth gradient — a private company with identical exposure has no equivalent trigger — and this is the same mechanism in the UK, at a supplier far smaller than a US casino operator.
Four Days Is Fast By This Corpus’s Standards
Marquis discovered on the day and told client institutions 74 days later, at 25-1027. LVMH brands disclosed a January compromise in May, at 25-0710. Breached in 2024 and disclosed in 2026, at 26-0515.
Four days from discovery to public disclosure is at the fast end of anything in this database — and it happened because a listing obligation applied, not because a health-data regime required it.
Which Is An Argument For The 24/72 Regime
The UK Bill proposes two-stage reporting at 25-1119: initial notice at 24 hours, fuller report at 72. This desk filed that as the fix for the layered-notification gap at 25-1027.
Securities disclosure achieves something similar by accident, for listed companies only. A general obligation would extend the same speed to the private suppliers that produce most of the incidents in this database.
The corpus now has two files — 25-0923b and this one — where the market regulator surfaced an incident the data regulator would not have.
It records a disclosure route observed at 25-1214b and connects it to the record-formation argument in this database. Corrections: corrections@forensicpost.com.