If the company made a mistake that non-public personal information of customers have been obtained by anyone with access to the Internet. Does the company have a legal duty to notify the affected customers of the breach? Does the company have an ethical duty to disclose the breach?