So I guess this means if our funds are on an exchange and the exchange realizes there was a hack, they have to notify the users and file a report.

Seems reasonable.