It’s not a real data breach unless it causes people serious harm. Words to that effect are rife throughout privacy reforms that continue to prioritise the responsible organisation over the impacted individuals https://www.ashurst.com/en/insights/queenslands-ipola-guidelines-new-mandatory-notification-data-breach-scheme/