If you run a public company and someone steals your customer database, the standard public relations playbook requires you to announce two things.