How Long Do Companies Take to Report a Data Breach? Evidence From 1,675 Washington Notices

How long do companies take to report a data breach? Longer every year. In notices filed with the Washington State Attorney General in 2025, the median time from discovering a breach to filing notice was 134 days, up from 36 days in 2020, and 87% of notices came more than 30 days after discovery, the window set by state law.

What does Washington law require?

Those exceptions matter for reading this data. A notice filed after day 30 is outside the default window, but this dataset does not record whether an exception applied, so it cannot show how many late notices were permitted.

How long after discovery are breaches reported?

Of 1,652 notices with timing data, 336 (20%) were filed within 30 days of discovery. 76 were filed more than a year after discovery.

Is breach reporting getting slower?

The median rose from 36 days in 2020 to 134 days in 2025. The slowdown is concentrated in ransomware notices. Their median went from 36 days in notices filed in 2020 and 2021 to 165 days in 2024 to 2026, while other cyberattacks moved from 74 to 84 days and non-cyber breaches from 63 to 74 days. Ransomware notices did not become more numerous; they became slower.

The dataset does not record why a notice took longer. A plausible reading is that ransomware with data theft now requires extended forensic review to establish which records were taken, which the statute’s scope exception allows, but that is an interpretation, not a measured cause. A single third-party incident can also generate many notices with similar timing and shift a period’s median.

Which sectors take longest?

What causes the breaches?

1,207 of the 1,675 notices (72%) were cyberattacks, 377 unauthorized access, and 91 theft or mistake. Among cyberattacks, ransomware was the most common type (592), followed by malware (224) and phishing (112).

Frequently asked questions

How long do companies have to report a data breach in Washington?

RCW 19.255.010 requires notice to affected consumers, and to the Attorney General when more than 500 Washington residents are affected, no more than 30 days after the breach is discovered, with exceptions for law enforcement requests and measures needed to determine the breach’s scope.

How long do companies actually take to report breaches?

In 2025 notices filed with the Washington Attorney General, the median was 134 days from discovery to notice, and 87% exceeded 30 days.

Is reporting getting faster or slower?

Slower. The median rose from 36 days for notices filed in 2020 to 134 days in 2025, driven mainly by ransomware notices, whose median went from 36 to 165 days.

How long does it take to discover a breach?

The median across Washington notices is 16 days from the start of the breach to discovery, with a long tail of breaches found months later.

What causes most reported breaches?

Cyberattacks, 1,207 of 1,675 notices; ransomware is the most common cyberattack type, with 592 notices.

Does a notice after 30 days mean the company broke the law?

Not necessarily. The statute allows delays requested by law enforcement and delays needed to determine the scope of the breach and restore system integrity. This data does not show which exception applied.

Methodology

References

1. Washington AGO, Data Breach Notifications Affecting Washington Residents. Accessed October 2026.
2. RCW 19.255.010, Disclosure, notice. Accessed October 2026.