I mean, what would the impact of them committing securities fraud be? Who would go after them and how much would the ensuing lawsuit cost them? The government isn’t gonna go after them if they asked them to keep it quiet.

Probably significantly less than telling their customers they’ve known about and hidden the fact that their systems were compromised for years (even if it was at the behest of the government).