I wonder if the evolution of law enforcement to this attack will be to have a court issue a gag order preventing said companies from notifying their users of attempted or successful attacks.
> When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.
(Source: https://gdpr-info.eu/art-34-gdpr/)