Back when Evernote was hacked, I got the idea of creating a draft of the kind of response I would prefer in a case like this.

I also intended to write a simple website script that could generate a statement. Things came up, and the gist has gathered dust for a while.

The gist is available here with some example cases listed that companies can learn from, and people are free to provide feedback or spin it off:

http://pygm.us/EwNHanBP

Post your most important feedback in its comments, so other companies reading the gist see it as well.

Companies definitely need to be prepared for full disclosure in the event of a security breach.