<img src="https://ml.globenewswire.com/Resource/Download/1ce629fb-a0a2-4f56-b4a8-93ca9ad7c332?size=2" nborder="0" align="left" hspace="5" vspace="5" title="BreachRx Logo-FullColor.png" alt="BreachRx Inc."/>Analysis of five major cyberattacks finds reporting obligations now outpace the ability of traditional incident response processesSAN FRANCISCO, July 22, 2026 <a href="https://www.globenewswire.com" target="_blank">(GLOBE NEWSWIRE)</a> -- <a href="https://www.globenewswire.com/Tracker?data=onsrvwFJTyfR_lr0MJ4val7pdEXAjN1hpAn_vZvEC4VjRDnjWEsJrWnr3iqD-ffD736ZOvTMFutiY6hsV8ZMdnFlrua035wEipoBco3aSaJVaFgeGrUuvIF4XyV5Ls-osdbwlUvjosYLpJOb_ofdjdWCiZzoTYlhx3fy_LiHa9Q4BgfHbqaqysXmRNhly0Xc" rel="nofollow" target="_blank" title="">BreachRx</a>, the leader in cybersecurity incident response management (CIRM), today released new research quantifying how major cyberattacks can generate hundreds of simultaneous reporting obligations across regulators, customers, partners, insurers, and other external stakeholders, while forcing executives and boards to make high-stakes decisions before investigators have established stable facts. The report, Regulatory Concurrency: Why Cyber Incident Reporting Has Become a System-Scale Problem, analyzes five high-impact cyberattacks, including Change Healthcare, Snowflake, the Salesforce OAuth campaign (Salesloft/Drift), 700Credit, and Salt Typhoon. Based on analysis of these incidents, the report finds that regulatory concurrency can produce more than 100 reporting obligations inside one organization, over 200 obligations across a small set of affected entities, and another 300+ obligations when incidents cascade across connected third-party systems. <img alt="BreachRx Regulatory Concurrency Report" height="422" src="https://ml.globenewswire.com/Resource/Download/0c912ed3-c4e4-4dc9-80ae-fba60056abb0/breachrx-regulatory-concurrency-report.png" width="600" data-dpi="96" data-caption="BreachRx finds that regulatory concurrency can produce more than 100 reporting obligations within a single organization, over 200 obligations across a small set of affected entities, and another 300+ obligations when incidents cascade across connected third-party systems." data-filename="BreachRx Regulatory Concurrency Report.png" /> The report introduces regulatory concurrency as the operational challenge that arises when dozens or hundreds of legally significant reporting workflows begin simultaneously, while the underlying facts remain uncertain. Across the incidents studied, the challenges included overlapping clocks, unstable facts, distributed responsibility, and fragmented disclosure workflows. Rather than a compliance problem, the research finds that the regulatory concurrency has become a system-scale coordination problem spanning security, legal, privacy, communications, executive leadership, and external stakeholders. “Organizations have under-invested in enterprise-wide incident response to manage the workflows outside of technical containment and remediation,” said Andy Lunsford, CEO and co-founder at BreachRx. “Today’s cyber incidents create dozens or hundreds of concurrent reporting decisions while facts are still changing. That’s no longer a detection problem; it’s an incident response management problem.” Five Patterns Found Across Major Cyberattacks The report identifies five regulatory concurrency patterns that now shape major incident reporting. <ul type="disc"><li>Change Healthcare showed vertical concurrency, with more than 100 modeled reporting obligations and a disclosure lifecycle that extended for more than 17 months as the affected population grew to approximately 192.7 million individuals.</li><li>Snowflake showed horizontal concurrency, with a shared root cause campaign forcing many independent organizations to investigate, assess, and report separately. Across only three publicly analyzed affected organizations, the report modeled at least 209 reporting obligations.</li><li>The Salesforce OAuth campaign showed cascading concurrency, with compromised tokens and credentials expanding the incident boundary and creating more than 300 modeled obligations across a limited set of affected organizations.</li><li>700Credit showed definition-driven concurrency, in which timing ambiguity and legal trigger interpretation created reporting risk regardless of incident scale.</li><li>Salt Typhoon exhibited constraint-driven concurrency, where national security and law enforcement sensitivities limited what could be publicly disclosed, creating reporting complexity even with a smaller number of visible obligations. </li></ul> Across these cases, BreachRx identified five recurring failure points in current incident reporting models, including misaligned reporting clocks; disclosure drift as facts change; responsibility gaps at organizational boundaries; decision logic that becomes difficult to reconstruct; and artifact sprawl that outpaces team control. The report concludes that regulatory concurrency has transformed incident reporting into an enterprise workflow challenge. A single incident may require security, legal, privacy, compliance, communications, executives, outside counsel, downstream partners, and regulators to operate from the same evolving fact base under severe time pressure. "Regulators don't punish organizations for having a hard incident. They punish them for telling an inconsistent story about it," said Stephen Garcia, CISO at BreachRx. "Every one of these disclosures is really a trust decision dressed up as a legal deadline. If you can't show your work months or years later, exactly what you knew and when you knew it, you don't have a compliance problem. You have a trust problem, and those cost far more to fix." The research supports BreachRx’s broader view that enterprise incident response has entered a new era. Technical containment remains critical, and enterprise risk increasingly turns on whether organizations can coordinate cross-functional execution, manage regulatory workflows, preserve privilege, maintain narrative consistency, and document decisions in real time. Based on the five incident patterns, the report concludes that organizations need six operating capabilities to manage regulatory concurrency at scale: <ul type="disc"><li>Real-time regulatory obligation mapping;</li><li>A centralized clock ledger for active reporting deadlines;</li><li>Real-time evidence capture;</li><li>Fact consistency enforcement across disclosures;</li><li>Workflow orchestration across stakeholders; and</li><li>Decision rationale logging for later defensibility.</li></ul> The research also explains why BreachRx developed the Rex Platform, an agentic AI platform for enterprise incident response that operationalizes these six capabilities. Rex helps organizations coordinate response across security, legal, privacy, communications, executives, and external partners, while tracking obligations, preserving a defensible record, and managing incident response as a system-driven workflow. “The research shows that incident reporting now behaves like a state-management problem,” added Lunsford. “Facts, obligations, stakeholders, and outputs all move at once. Organizations need to know which version of the facts supported each disclosure, which clock was running, who approved each decision, and whether the record will hold up months later.” The full report, Regulatory Concurrency: Why Cyber Incident Reporting Has Become a System-Scale Problem, is available at <a href="https://www.globenewswire.com/Tracker?data=IXtsaAbIZdW-b4X_GrydTznV-ObIvYU4Qcf1gbrqgAa_CzHpW_ujUHKxT2Tz4MCpZ5fXxZNYcNwtr61VynZ-0q4YIyyh-C59BF7-DNp6y5YjsJxlguXsCXa7gEpSFDW5bS7MAmMWLv70t4pFXQn_SHsnVsdA1Dq-oVKBkT1hoJ4FgZQ3KpJwEIeBMhejM1wxY-oLjfoVOk4YMqe7Qkpzde0r4hxddKVMBhbYTIbtmjTVAzRD5QESqSPsu6ZXvvkK7suFZIuWwXMBv54vF1GTcIPy7_XYh6a1INvz2Qo_tJE=" rel="nofollow" target="_blank" title="">https://info.breachrx.com/regulatory-concurrency-report</a>. About BreachRx BreachRx offers the Rex Platform, an agentic AI platform that helps enterprises respond to cyber incidents and other disruptive events. As AI-driven threats increase the volume, speed, and simultaneity of incidents, organizations are now facing a continuous state of disruption. Enterprise response is even more mission-critical and Rex elevates incident response to a coordinated, enterprise-wide capability spanning security, IT, legal, communications, and executive leadership. The platform provides intelligent agents to manage the response, clarifying ownership, adapting playbooks, and coordinating stakeholders as incidents evolve. Organizations can manage scale, reduce chaos, and maintain control under pressure. The result is faster, more consistent response, less chaos, and confident, defensible decisions at scale. Media Contact: Susie Dougherty for BreachRx <a href="https://www.globenewswire.com/Tracker?data=onsrvwFJTyfR_lr0MJ4vakbJI63mndufkjDGCB0Vo0ATbFpuhOglrhpNn2DOQvYWNRAnuRrQtaV5q1ZOZlubN3n7Am4PeJxadH0Mk_P-InWEBIciit7r7xUXk1i-yA04" rel="nofollow" target="_blank" title="">BreachRx@marketbridge.com</a> A photo accompanying this announcement is available at <a href="https://www.globenewswire.com/Tracker?data=IXtsaAbIZdW-b4X_GrydTwstmNUBA4pqD3028Cu0jX7nnC5pHik39BtVY97QknxlxiNDsIrp7WqMyPisW-mMNl5oWiJUTywEj-6Jb_WKmFgi6t9GAL4FctwAVyRtT2HzRMdWhLp7VP0_6WB10C5BRQgVJKPKLRDY9l6vCtjsvyZjhOkJICuQJt-UwiYFsFwpJX3srY4SkW-LH9gSY5lB3wUDXdRhFA94GkXDQ1UAZw_uDfrkzONYoLlEBBoRbfcbyJCbjQ1BfvBtFSUyiyfQbA==" rel="nofollow" target="_blank" title="">https://www.globenewswire.com/NewsRoom/AttachmentNg/0c912ed3-c4e4-4dc9-80ae-fba60056abb0</a> <img alt="" src='https://ml.globenewswire.com/media/YzQ1NzkzMDctM2NkYS00MmQ1LTg0NGItZDU5NzJhMjUwZTI3LTEzMjExNjQtMjAyNi0wNy0yMi1lbg==/tiny/BreachRx-Inc-.png' referrerpolicy='no-referrer-when-downgrade' />

GlobeNewswire Inc.

BreachRx Research: Modern Cyberattacks Create Hundreds of Simultaneous Reporting Obligations Before the Facts are Known

Latest news from the world of business and finance – both local and global

MONEY FM 89.3 is Singapore's first and only Business and Personal Finance station, featuring local and international business and financial news.

MONEY FM 89.3

Discover newsletters from our DJs on LinkedIn