I think the headline is fair. In the UK, the ICO requires [1] that breaches are notified within 24 hours of a breach being established. 2 months is a long time and the media is right to paint a negative picture. I suspect it is similar within the EU and I hear it is only going to get stricter once GDPR comes into force next year.

[1] https://ico.org.uk/for-organisations/guide-to-eidas/breach-r...