When it comes to disclosing hacks, standard practice is to disclose a small hack first then disclose that the hack was "worse than previously thought".

Examples:

https://www.slashgear.com/outlook-com-hacks-is-worse-than-mi...

https://news.vice.com/en_us/article/a3pqqb/the-facebook-hack...

https://www.scmp.com/news/hong-kong/law-and-crime/article/21...

https://www.theregister.co.uk/2018/02/13/equifax_security_br...

https://www.trustedreviews.com/news/ba-hack-investigation-36...

https://www.thedailybeast.com/iran-hack-worse-than-reported