Agreed. I am assuming they will not do it for the same reason yahoo didn’t. They are simply afraid of losing too many active users.
Yahoo’s case was worse though, since it was hacked.
Yahoo’s case was worse though, since it was hacked.
Based on that I'd say it would be pretty safe to disclose a breach and reset all passwords; if your service is relevant your users will stay with you, and if not then not disclosing a breach will only buy you time before the inevitable happens anyway.
Twitter did disclose this, through email and on first login. Anyone they'd lose because of the breach is long gone and I also think it's probably next to nobody.