breach occurred Oct. 17