Financial services

1. Self-reported a breach affecting three hundred and forty clients six weeks after finding it: remediation program and a letter. A firm I know sat on a comparable one until a complaint surfaced it and was still in it three years later.

2. Below roughly $50k aggregate client loss with a clean history, what we saw repeatedly was remediation rather than enforcement. That threshold is in no regulatory guide.

3. The first notice covered four years. Counsel rang the officer, explained the volume, and it came down to eighteen months and two product lines in one call. Nobody outside knows ringing is an available move.