When should the data breach clock start?