Jerry Moran actually said...

The fact that the company took approximately a year to notify impacted users raises red flags within this committee.

Without objection, they'll be entered.

What's the obligation to report the payment or the breach to law enforcement and once a bounty is paid, is that obligation changed?

We urge you to use all the tools at your disposal to take immediate action to investigate this company...