"He had the obligation to report not only the security breach..."