Communication! This is a key element in the incident management procedure when a data breach has been discovered by a company or organization. Soon, in the United States, it will become mandatory to report data breaches:

“It would make it illegal for a company to conceal a breach if it resulted in unauthorized access to sensitive personal information. Entities that experience the breach of such data would have to notify the affected victims and consumer reporting agencies if the breach involves more than 5,000 individuals. They would have to notify the U.S. Secret Service if the intrusion involves more than 10,000 individuals.”

Source: wired.com, govinfosecurity.com.