I completely agree. Taking months to let tens of millions of people know their information was compromised isn't acceptable, no matter whether or not you know all the details about it. (The obvious exception being an as-of-yet insecure point of attack.)