duty to disclose hacks