saying "admit" when a company says they had a security breach is just likely to make them not report them in the future