Instacart has not yet reported this breach to the California attorney general, like they're supposed to.[2] There's a long list of companies with data breaches there.
[1] https://leginfo.legislature.ca.gov/faces/codes_displaySectio...
If it’s a leaked-passwords attack used to compromise an unknown number of accounts that had insecure passwords, is it possible for Instacart to prove a breach occurred to the degree necessary to trigger the notification requirement?
Is it even a breach at all, in that scenario? How is Instacart at fault?
Is it necessary to integrate with haveibeenpwned to avoid having to publish a new breach notification every day that at least X accounts with an insecure password are accessed without consent? Is this requirement codified in law, or must each business discover it the hard way?
Not certain about what is legally expected however.
Tools like haveibeenpwned typically rely on companies' cooperation to report breaches since "data breach" is a legal term. But since Instacart still hasn't reported this, do the security tools get updated in a timely way, or are there millions of credit cards and passwords sitting up for sale while lawyers figure out how to handle the legal side of this?