Up to six million customers exposed in 2025; records published in 2026. Notification law assumes an incident that ends.
Publication is its own phase, timed for reasons unrelated to the victim. Nobody is required to tell affected people when it happens.
An airline reading about Hawaiian on a Monday had, at most, a fortnight.