“Privacy breach framing emphasizes unauthorized access and vulnerability; 'found to be' suggests discovery of existing problem rather than isolated incident.”