Does claiming you were hacked when you had really just screwed up violate the FTC Act?

If entities continue to obfuscate and lie, it's time to mandate more transparency in breach disclosures.

Why 'may have been taken?' Do they know and just aren't being forthright, or if they don't know, why don't they know?

Read at Databreaches