When Should Companies Disclose? Actual Practices and Guidance for Announcing Cyber Incidents

Based on MBSD's analysis of domestic companies' disclosure practices (about 500 incidents, about 800 disclosure documents including follow-ups), we find that while first reports are often released relatively early, the scope and impact of damage frequently become more concrete in follow-up reports as investigations progress. MBSD's aggregation shows that "from occurrence or discovery to the first report, about half are within 5 days and about 80% are within 30 days," with a median of 5.6 days and a mean of 27.1 days (source cited). Note that the average is pulled up by some long-running cases.

The article first clarifies that "public disclosure," "customer notification," "administrative reporting," and "sharing with the police or specialized agencies" have different purposes and audiences. Because the "initial/confirmed" reports used for reporting to the Personal Information Protection Commission and a company's own "first report/follow-up" communications do not align neatly between regulatory processes and public relations, the article argues that reporting deadlines should not be used directly as a benchmark for general public disclosure.

There are also trends in the number and content of disclosures: MBSD observed that about 60% of incidents end with a single disclosure, and about 90% with three or fewer. First reports tend to focus on the current situation with descriptions such as "unauthorized access," "restored," or "under investigation," while follow-ups more often concretize impacts like "data exfiltration/personal information" or "encryption." Importantly, even when the initial report states "under investigation," companies should provide recipients with the information needed to make decisions, such as actions customers or business partners should take and contact points for inquiries.

The article also explains why not everything should be disclosed immediately. Technical details can be shared confidentially with specialist organizations to help prevent damage to other companies, whereas publishing such details publicly may hinder containment or investigation. Therefore, it is necessary to distinguish what is released publicly and what is shared with specific parties. Finally, as a practical preparation to enable swift and accurate disclosure decisions, the article recommends predefining roles in peacetime: persons who gather facts, external consultation contacts, those who decide on disclosure, those who deliver information to recipients, and those who manage updates.