Do We Need Tougher Breach Notification Rules?

When London-based currency exchange company Travelex was hit by a ransomware attack on New Year's Eve, it delayed admitting the nature of the problem, and didn't report the incident to the UK's Information Commissioner's Office as required by the GDPR, based on the rationale that the data had merely been encrypted, not exfiltrated.