Consumer group says security breach a wakeup call; true move H gets seven days to implement additional measures.