Nah. If we ever had to pull this specific trigger we're already in "mandatory disclosure to individuals whose data was breached, the federal government, and possibly the media" territory.

It's one thing to try to duck bad publicity, it's another to not act quickly and risk the ire of the federal government.