John Z Black
Brunswick, ME • (207) 245-1010 • contact@johnzblack.com
The technical breach is usually the headline. In financial supply chains, it’s often not where the real damage peaks.
Months after the original Marquis incident, updated reporting put the impact count north of 670,000. That timeline is the story. Delayed disclosure compounds damage in three directions at once: operational drag as customer notice and remediation stretches out, trust erosion as stakeholders read uncertainty as weak control, and legal pressure as boards and regulators ask whether disclosure timing matched what was actually known.
None of this requires bad faith. Slow forensic convergence plus poor communications design is enough.
What good looks like: staged impact language defined in advance, update triggers tied to forensic confidence levels, and separating what’s technically unknown from what affected parties can act on right now. Disclosure is a milestone, not the finish line.
If you rely on software or data vendors in regulated workflows, ask how they handle rolling impact revisions. Not whether they have an incident response policy PDF. Whether they know how to communicate when the facts are still changing.
Read the full post on what disclosure maturity actually looks like and what to ask your vendors