I have sufficient regulatory grounding now. Let me address both items.
Item 1: Stock Exchange Executive Espionage — Notification Obligations
This is a complex multi-jurisdictional scenario. Five months of SYSTEM-level access to a senior executive's mailbox containing deal terms, listing details, enforcement matters, and executive calendars triggers overlapping obligations across at least four regulatory frameworks.
EU GDPR (Article 33 & 34)
Under Article 33(1) GDPR, the exchange—as controller—must notify the competent supervisory authority (DPA) without undue delay and, where feasible, not later than 72 hours after having become aware of it. The personal data involved (executive calendars, communications) clearly meets the breach definition under Article 4(12).
The critical question is when did the clock start? Under EDPB Guidelines 9/2022, "awareness" means when the controller has a reasonable degree of certainty that a security incident compromising personal data has occurred. If detection was recent but the intrusion spans five months, the notification obligation runs from discovery, not initial compromise.
Under Article 34, data subject notification is required where the breach is likely to result in a high risk to rights and freedoms. Executive calendars and deal correspondence? That's likely high risk—these individuals face targeted phishing, physical security risks, and market manipulation threats.
SEC Cybersecurity Disclosure (Item 1.05 Form 8-K)
If this exchange files with the SEC or has US-listed securities, four business days from materiality determination—not from discovery. The materiality assessment process itself must be documented.
The threshold: would a reasonable investor consider this incident important to an investment decision? Five months of executive mailbox access affecting deal terms and enforcement matters? Materiality is almost certainly triggered. That 4-day clock is running.
Market Abuse Regulation (MAR) — EU Listed Entities
Under MAR Article 17, issuers must publicly disclose inside information as soon as possible. The question is whether this incident itself constitutes inside information, or whether it reveals inside information about listed clients.
If the compromise gave attackers visibility into pending listings, M&A activity, or enforcement actions against listed companies, the exchange may have parallel disclosure obligations to those issuers. This is underexplored legally—most MAR guidance focuses on the issuer's own inside information, not information held by infrastructure operators.
Duty to Listed Companies
This is where it gets murky. Under general confidentiality and data processor obligations (if the exchange processes data as processor for listed clients), Article 28(3)(f) GDPR requires notification without undue delay. But market practice obligations are stronger: exchanges typically have contractual duties to notify listed entities of security incidents affecting their data. If absent, expect regulatory inquiry.
Concrete penalties: Under GDPR, up to 2% of global turnover or EUR 10M. Under NIS2 (if the exchange qualifies as an essential entity—highly probable), up to EUR 10M or 2% of global turnover. This is not a single-point-of-failure scenario—obligations stack.
Item 2: CISA June 3 Deadline — Incident-Presumption Posture
I could not verify current status of CVE-2026-41091 and CVE-2026-45498 via regulatory sources. However, under BOD 22-01, Federal Civilian Executive Branch (FCEB) agencies must remediate Known Exploited Vulnerabilities within 72 hours when active exploitation is confirmed.
For organizations that cannot confirm patch status, my recommendation is yes—adopt incident-presumption posture, but with nuance:
FCEB agencies: Clock has expired. Non-compliance must be reported to CISA. The presumption is not optional—it's a reporting trigger.
Private sector: No statutory deadline, but under NIS2 Article 23 (for essential/important entities) and SEC S-K Item 106 (for registrants), inability to confirm patch status creates a risk management documentation requirement. You cannot certify controls as effective if you cannot confirm vulnerability status.
Materiality consideration: CISA deadlines often correlate with exploitation in the wild. If unpatched, this shifts probability-weighted impact assessments. Document your inability to verify—this is now an audit trail issue.
Summary action items:
- Exchange compromise: GDPR 72-hour DPA notification clock is likely active now; SEC materiality assessment must be documented and 4-day disclosure prepared; MAR inside-information analysis required for listed-client exposure
- CISA deadline lapsed: FCEB agencies must report non-compliance; private sector should document patch-status uncertainty as control deficiency