When a company is actually the victim of a computer attack, the company may be required to disclose the incident, its impact on operations and what steps have been undertaken to prevent a future problem.
FORBES: Disclosing Cyber Security Incidents: The SEC Weighs In