"I am deeply troubled by these latest data breaches and the decision by both Epsilon and Sony not to testify today. This is unacceptable," said Mack, a California Republican, in her opening remarks. "The single most important question is simply this: Why weren't Sony's customers notified sooner about the cyber-attack?"

Sony told customers that their personal information had been stolen in a breach of its PlayStation Network on April 26, about a week after figuring out that it had been hit by hackers. While that may not be quick enough for many gamers -- already vitriolic because their online gaming services had been yanked -- it's actually a pretty quick notification, especially for a breach of this magnitude, according to many data breach and security experts.

"I was stunned at the reaction, that people were saying a few days was too long," said "Dissent," the anonymous operator of the website, and a close tracker of data breaches. "A year ago, if somebody notified you in less than two months, that was considered really fast. I think now the public has this expectation that they're going to be notified right away."

In late April, it seemed that Sony could do nothing right. Criticized for dragging its heels, the company published information about the breach before it fully realized how deeply it had been compromised. It then had to undergo a series of embarrassing corrections. It discovered that a second network, Sony Online Entertainment, had also been hacked, and then had to admit that bank card numbers had indeed been stolen, contrary to its earlier assessment.

In fact, it's common for companies to learn that breaches are more serious than first thought. That's what happens as security experts are brought in and the forensic investigation progresses. Sony just had the misfortune of having its investigation scrutinized, said Rob Lee, a computer forensics instructor with the SANS Institute. "Their story changing is actually quite normal," he said. "The fact that this is public is what makes it abnormal."