Perhaps if the penalty is based on days since exposure--immediately revealing the breach gets you a minimal fine, but waiting six weeks is enough to cause a major fine (or add to sentences for fraudulent trading related to the incident), and years is even bigger?