Corporations are people… except when those people need to go to jail.

The article does say that the Justice Department ordered them not to disclose immediately

It actually seems like it was three months. From a different article

The company wrote that it first learned of the incident in April, but the U.S. Justice Department determined in May and again in June that “a delay in providing public disclosure was warranted” until now.

Either way, we deserve a full answer on that delay

Lesson number 2 should be “you can’t do everything for yourself in theory or escape these things in practice, we need sensible regulation of our systems”