The EU GDPR mandates that a company reveal the breach and its specifics within 72 hours of learning about here. It seems OnePlus took longer.source https://www.news18.com/news/tech/hackers-know-your-address-and-phone-number-but-oneplus-thinks-all-youll-get-is-spam-2398907.html
