The incident began with a message from the security team and a difficult question from the chief executive: should customers be notified now, or should