Re: re. Reporting a breach shows awareness
It has always been a wonder to me that companies can get away with not reporting. If, for example, your local branch of your bank got visited by a couple of gentleman equiped with stocking masks and shotguns and they failed to report the matter to the police then the bank could be punished for failing to report knowledge of the commission of a criminal offence. Companies that conceal attacks on their IT-systems should be prosecuted for failing to report said offence. The senior managers responsible should end up in court.