The real question is why not? Its not like HP will be fined to the tune of tens of millions for the breach, at best they will get stern reprimand letter.