They should have 7 days from the moment they find out about the breach imo. Why is it that every time you deal with banks, if it involves you paying them the transaction is approved instantly, and is expected to be done ASAP but when it’s flipped it takes 3-5 business days and “well we have a lot of customers”.