A retail company confirms a breach in which an attacker accessed a database containing customer names, email addresses, and hashed loyalty-program passwords, but no payment card data or government identifiers. The incident commander is drafting external communications and must decide who needs to be notified first from a stakeholder perspective. Which factor should MOST directly determine which external parties must be formally notified?