It's not using competitors misfortune if they didn't reasonably disclose the breach