The bigger problem I see is it incentivizes them never to come forward, or to massively downplay an attack. I guess if the damage is small enough and the penalties for nondisclosure astronomical enough (or that pierce the corporate veil), it could still work though.