Furthermore, it is not as if the breach had just been discovered: Uber had already investigated the issue to the point where it paid the blackmail, so I suspect the then chief of security and his staff already knew enough to make a responsible, if preliminary, disclosure - and to initiate the credit-monitoring program.