We assess severity promptly and, where required by law, notify affected users and regulators without undue delay. Notifications include the nature of the breach, likely consequences, and steps taken.