Hacker News Reader

Yes, usually breaches take time to detect, and usually the attackers are around for a while first.

I'm sure they want answers too, but they're working on it, and this is what they have right now.

Your options are: (A) Vendor waits until all the facts are in place and the investigation is finished or (B) Vendor tells customers as early as practical so they can take their own mitigation steps.

You do not have the option of (C) Vendor should tell me about a breach they don't yet know about.

How does it feel to want? They are doing their due diligence currently.

Give them some time.