As an MSU grad, I feel like they handled this well. As anyone who reads Brian Krebs' site can tell you, a lot of companies have waited months to make similar announcements. It took them a week. Two years of protection is generous as well—usually it's a year in such breaches.

And I say that not being a rah-rah alum, either.