In Canada (unless it has changed) I believe it is still voluntary. Reporting would be to the Office of the Privacy Commissioner. Best practice is to inform the individuals whose data was compromised.

As an example, about three months ago I received a letter in the mail from Sabre (the reservation system). It basically gave a date range for the reservation and said one of the hotel in the US that uses their platform was compromised. It did not provide the name of the hotel, so I can only narrow it down to four US hotels, three are regional chains and one is a major Vegas property.

As far as AC past reporting, no idea.

As far as the likelihood that the outage was the result of a hacker, I go back to my comment that hackers these days are more motivated by money and stealing credit and personal data that they can then resell. Last thing they would want to do is bring down the system that is feeding them their data.