Or when our 3 letter agencies do it.
Which is the much more likely answer if the breach actually occurred as reported.