I think companies shouldn't hesitate to take action when it comes to their users' personal data; it's such a sensitive issue that it can damage the company's reputation. Hackers have nothing to lose by exposing it, but the company stands to lose a great deal.