BreachRx Research: Modern Cyberattacks Create Hundreds of Simultaneous Reporting Obligations Before the Facts are Known

SAN FRANCISCO — July 22, 2026 — BreachRx, the leader in cybersecurity incident response management (CIRM), today released new research quantifying how major cyberattacks can generate hundreds of simultaneous reporting obligations across regulators, customers, partners, insurers, and other external stakeholders, while forcing executives and boards to make high-stakes decisions before investigators have established stable facts.

The report, Regulatory Concurrency: Why Cyber Incident Reporting Has Become a System-Scale Problem, analyzes five high-impact cyberattacks, including Change Healthcare, Snowflake, the Salesforce OAuth campaign (Salesloft/Drift), 700Credit, and Salt Typhoon. Based on analysis of these incidents, the report finds that regulatory concurrency can produce more than 100 reporting obligations inside one organization, over 200 obligations across a small set of affected entities, and another 300+ obligations when incidents cascade across connected third-party systems.

The report introduces regulatory concurrency as the operational challenge that arises when dozens or hundreds of legally significant reporting workflows begin simultaneously, while the underlying facts remain uncertain. Across the incidents studied, the challenges included overlapping clocks, unstable facts, distributed responsibility, and fragmented disclosure workflows. Rather than a compliance problem, the research finds that the regulatory concurrency has become a system-scale coordination problem spanning security, legal, privacy, communications, executive leadership, and external stakeholders.

“Organizations have under-invested in enterprise-wide incident response to manage the workflows outside of technical containment and remediation,” said Andy Lunsford, CEO and co-founder at BreachRx. “Today’s cyber incidents create dozens or hundreds of concurrent reporting decisions while facts are still changing. That’s no longer a detection problem; it’s an incident response management problem.”

Five Patterns Found Across Major Cyberattacks

The report identifies five regulatory concurrency patterns that now shape major incident reporting.

• Change Healthcare showed vertical concurrency, with more than 100 modeled reporting obligations and a disclosure lifecycle that extended for more than 17 months as the affected population grew to approximately 192.7 million individuals.
• Snowflake showed horizontal concurrency, with a shared root cause campaign forcing many independent organizations to investigate, assess, and report separately. Across only three publicly analyzed affected organizations, the report modeled at least 209 reporting obligations.
• The Salesforce OAuth campaign showed cascading concurrency, with compromised tokens and credentials expanding the incident boundary and creating more than 300 modeled obligations across a limited set of affected organizations.
• 700Credit showed definition-driven concurrency, in which timing ambiguity and legal trigger interpretation created reporting risk regardless of incident scale.
• Salt Typhoon exhibited constraint-driven concurrency, where national security and law enforcement sensitivities limited what could be publicly disclosed, creating reporting complexity even with a smaller number of visible obligations.

Across these cases, BreachRx identified five recurring failure points in current incident reporting models, including misaligned reporting clocks; disclosure drift as facts change; responsibility gaps at organizational boundaries; decision logic that becomes difficult to reconstruct; and artifact sprawl that outpaces team control.

The report concludes that regulatory concurrency has transformed incident reporting into an enterprise workflow challenge. A single incident may require security, legal, privacy, compliance, communications, executives, outside counsel, downstream partners, and regulators to operate from the same evolving fact base under severe time pressure.

“Regulators don’t punish organizations for having a hard incident. They punish them for telling an inconsistent story about it,” said Stephen Garcia, CISO at BreachRx. “Every one of these disclosures is really a trust decision dressed up as a legal deadline. If you can’t show your work months or years later, exactly what you knew and when you knew it, you don’t have a compliance problem. You have a trust problem, and those cost far more to fix.”

The research supports BreachRx’s broader view that enterprise incident response has entered a new era. Technical containment remains critical, and enterprise risk increasingly turns on whether organizations can coordinate cross-functional execution, manage regulatory workflows, preserve privilege, maintain narrative consistency, and document decisions in real time.

Based on the five incident patterns, the report concludes that organizations need six operating capabilities to manage regulatory concurrency at scale:

• Real-time regulatory obligation mapping;
• A centralized clock ledger for active reporting deadlines;
• Real-time evidence capture;
• Fact consistency enforcement across disclosures;
• Workflow orchestration across stakeholders; and
• Decision rationale logging for later defensibility.

The research also explains why BreachRx developed the Rex Platform, an agentic AI platform for enterprise incident response that operationalizes these six capabilities. Rex helps organizations coordinate response across security, legal, privacy, communications, executives, and external partners, while tracking obligations, preserving a defensible record, and managing incident response as a system-driven workflow.

“The research shows that incident reporting now behaves like a state-management problem,” added Lunsford. “Facts, obligations, stakeholders, and outputs all move at once. Organizations need to know which version of the facts supported each disclosure, which clock was running, who approved each decision, and whether the record will hold up months later.”

The full report, Regulatory Concurrency: Why Cyber Incident Reporting Has Become a System-Scale Problem, is available at https://info.breachrx.com/regulatory-concurrency-report.