Bitcoin extortion plot targeted Churchill Downs, but prosecutors and company kept it quiet

"Albert Gidari, director of privacy at Stanford University’s Center for Internet and Society, said a company that has suffered a breach has a duty to notify affected customers even though no further compromise occurred, because “with a criminal like this, there is no way to be certain of that.”"