So from the Article they claim:

"PayPal has since rolled back the code change responsible for this error, which potentially exposed the PII. We have not delayed this notification as a result of any law enforcement investigation."

That does little to explain the 2 month-ish delay in disclosing it. I presume they could have disclosed _at least_ that account data was leaked even if the underlying bug wasn’t yet closed?

Obviously without disclosing the nature of the bug in that case.

▲

malfist 2 hours ago | parent | next [-]

It's one of those "suspiciously specific denials"

They didn't delay the release because of law enforcement investigation, it doesn't say they didn't delay the release. There's a whole host of reasons besides "law enforcement investigation" to delay an embarrassing release, including "I don't wanna"

	▲	sidewndr46 2 hours ago \| parent [-]
		The quote is: "We have not delayed this notification as a result of any law enforcement investigation" The obvious example here would be if the NSA or other agency that isn't law enforcement led the investigation. But further abuse of the English language reveals a different conclusion. This was not delayed as a result of any law enforcement investigation. It could have been delayed as a result of a specific law enforcement investigation. Furthermore, the word "result" implies that it is tied to the conclusion of said investigation(s). It could in fact have been delayed because of a pending law enforcement investigation.

▲

motbus3 10 minutes ago | parent | prev [-]

Just before Christmas? I doubt it