This is also why folks advocate for a separate auth system (keycloak was just mentioned here on HN) since they are different types of information.

>I feel like at some point they're just going to go completely radio silent because the extent of the breach will become such that they'll have no choice but to just lawyer up.

I feel like they are heading this route as well. Possibly even withholding information in order to save the company from mass exodus due to the incident. I'm sure they'll be fine.