At the very least they should require full disclosure, including an analysis of how the hackers were able to breach their systems.

I believe that some laws requiring notification to customers in case of a data breach would already cover this. However, from another article I found this statement from CWT:

"While the investigation is at an early stage, we have no indication that personally identifiable information/customer and traveller information has been compromised."

That appears to be a complete lie based on the chat transcripts, and if so I hope CWT is punished legally for it.