OTOH, California was the first of many US states to require disclosure or notification of personal information security breaches,

https://en.wikipedia.org/wiki/Security_breach_notification_l...

and will soon be requiring disclosure of breaches of "personal information that would permit access to an online or email account"

https://www.huntonprivacyblog.com/2013/09/articles/californi...