What Constitutes a Misleading Statement in a Company’s Response to a Data Breach?

To ensure investor safety and emphasize a commitment to user privacy, corporate executives and similarly-situated high ranking officers must not provide any statements or omissions that affirmatively create a misleading impression of the current “state of affairs that differed in a material way from the one that actually existed.” But what qualifies as a misleading statement or omission?