The email arrives on a Tuesday afternoon. Subject line: “Important notice regarding your account security.” The company regrets to inform you that an unauthorised party accessed their systems. They may have obtained your name, email address, and password.
What the email doesn’t say: the breach happened six months ago. Attackers were inside the network for weeks before that. Your credentials were sold on a dark web market within 72 hours of the breach. Three separate criminal groups have already used them in credential-stuffing attacks. One of them accessed your old email account and used it to reset a password somewhere else.
You’re finding out now. The IBM Cost of a Data Breach Report puts the average time between a breach and its identification at 204 days. That’s not the time until you’re notified. That’s just when the company finds out.
The short answer: The breach notification gap exists because companies take months to even detect a breach (204 days on average, per IBM), then weeks more to contain it and prepare notices. Meanwhile attackers start exploiting stolen data within 24 to 72 hours. By the time your email arrives, your data has already been sold, reused, and profiled. Don’t wait for the notice: monitor Have I Been Pwned and watch for login anomalies so you find out first.
Was your data stolen months before you got the email?
The IBM figure of 204 days to identify a breach is an average across thousands of incidents. Add another 69 days for containment. The total breach lifecycle runs to 266 days before a company can even begin preparing notifications.
Attackers typically begin exploiting stolen data within 24 to 72 hours of exfiltration. Not weeks. Hours.
By the time your breach notification email lands in your inbox, your data has already been through a full criminal supply chain: exfiltrated, verified, listed for sale, purchased, and used. The email is a historical document. It’s telling you about something that happened to a past version of your data.
Why do companies take so long to notice a breach?
Attackers don’t announce themselves. They move laterally through networks — from an initial foothold (often a phishing email or a compromised contractor account) through internal systems, establishing persistence as they go. They read internal communications, map the data landscape, and exfiltrate carefully over time. Modern ransomware operators spend weeks inside networks before deploying their payload because they want to understand what’s valuable first.
The median time attackers spent inside a compromised network before detection was 16 days in 2023, according to Mandiant’s M-Trends report. That’s down from 416 days a decade ago — a genuine improvement in corporate detection capability — but still three weeks of silent access.
Many breaches aren’t discovered by the company’s own security team at all. External threat intelligence firms spot breach data appearing on dark web markets. Law enforcement notifies companies after identifying stolen data during criminal investigations.
The Marriott breach is the extreme case. Attackers had access to the Starwood guest database from 2014, and Marriott didn’t discover it until 2018. That’s four years and roughly 383 million guest records, found only during a post-acquisition security audit. Four years.
What happens after detection — before you’re told
Discovery triggers a process, not an announcement. Companies notify law enforcement — which often asks them to hold off on public disclosure to avoid tipping off the attacker. They engage forensics firms, bring in legal counsel, and patch the vulnerability before admitting anything publicly.
They prepare the notification text, set up a call centre for affected users, and decide whether to offer credit monitoring (and negotiate that contract).
This takes time. Under GDPR, companies must notify the relevant Data Protection Authority within 72 hours of becoming aware of a breach. But the regulation’s individual notification requirement says “without undue delay” — which has no hard deadline. Companies interpret this generously.
So: the DPA gets the 72-hour notification. You get “without undue delay,” which in practice often means weeks or months after the DPA was already told.
What your data is doing during the gap
The notification gap isn’t empty time. It’s the criminal opportunity window, and it has a structure.
Hours 0–72: Fresh breach data sells at a premium on dark web markets. New, unverified data commands higher prices because credential-stuffing attacks against it haven’t yet triggered mass password resets. Buyers know they have a window.
Weeks 1–8: Automated credential-stuffing runs against major services — email providers, banking portals, retail accounts. Attackers are looking for password reuse across sites. Phishing campaigns are built using the breached data to target victims with personalised lures (“we noticed unusual activity on your account at [company you actually use]”).
Months 2–6: Enriched profiling. Attackers combine your breached data with information from data brokers to build fuller profiles used for targeted fraud — account takeover, synthetic identity construction, social engineering.
When you get the email: Your data has already moved through multiple hands. The original breach data has been re-sold, combined with other breach data, and is now embedded in criminal databases that will be used for years. The notification is accurate — it’s just not timely in any way that helps you act before the damage.
What law requires — and doesn’t
Notification requirements vary so much by jurisdiction that “data breach law” is almost meaningless as a global concept.
GDPR (EU/EEA): Companies must notify the relevant Data Protection Authority within 72 hours. Individual notification is required only when the breach is “likely to result in a high risk to the rights and freedoms of natural persons.” Even then, it must happen “without undue delay,” with no hard deadline for reaching individuals. In practice, regulators have accepted weeks.
United States: There’s no federal breach notification law. Each state sets its own rules. Most require notification within 30–90 days of discovery. California is among the strictest. Some states have no deadline at all.
India: CERT-In requires organisations to report incidents to CERT-In within six hours of becoming aware. Six hours. That’s faster than GDPR’s 72-hour DPA notification requirement. But this only reaches the government. India’s older framework had no mandatory individual notification requirement: companies had to tell the government, not you. The Digital Personal Data Protection Act 2023 adds breach-notification duties, and the DPDP Rules were finally notified in November 2025. As of mid-2026, though, those duties phase in over 2026–2027, and the Data Protection Board is not yet fully operational. So direct individual notification is coming but not yet enforced in practice.
Australia: The Notifiable Data Breaches scheme requires notification within 30 days of becoming aware of an “eligible data breach.” That means a breach likely to result in serious harm to affected individuals.
UK (post-Brexit): The UK GDPR mirrors EU GDPR’s 72-hour DPA notification requirement. Individual notification rules are equivalent.
How can you find out before the notification arrives?
Waiting for the company email is the worst strategy available to you. Here’s what works instead.
Have I Been Pwned (haveibeenpwned.com): Free breach monitoring for email addresses. Sign up, and you’ll receive a notification whenever your address appears in a newly indexed breach dump. There’s a lag, but it catches far more than corporate notification timelines do.
Dark web monitoring: Services that scan dark web markets and breach repositories for your email addresses, phone numbers, and passwords. KnytX Shield is built to do this automatically once you’re in. When your credentials appear in a new dump, it’s designed to alert you before the company’s email arrives.
Login anomalies: Password reset emails you didn’t request, login alerts from unfamiliar locations, “someone signed in from a new device” — treat these as urgent, not routine.
Google’s Dark Web Report: Available to Google One subscribers. Monitors your Gmail address in breach data. Narrower than dedicated services but better than waiting.
Your best protection is detecting breaches before you’re told about them. By the time the notification email arrives, attackers already had a 204-day head start.
Frequently asked questions
How long before I’m notified about a data breach? Often months. Companies take an average 204 days just to detect a breach (IBM), then weeks more to contain it and prepare notices. Some jurisdictions set no individual-notification deadline at all.
Why does the law let companies wait so long? GDPR requires a 72-hour report to the regulator, but individual notice only “without undue delay,” with no hard deadline. US rules vary by state (30–90 days), and India has no enforced individual-notice duty yet.
What can I do during the notification gap? Monitor Have I Been Pwned, treat unexpected password-reset emails as urgent, and check whether your details are already surfacing on people-search sites. See our guide on how to check if your data was leaked.
Does deleting my account close the gap? No. Deletion stops future exposure but can’t recall data already sold. Change reused passwords and enable two-factor authentication on your key accounts instead.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.