If they can't provide it to us for national security purposes, certainly they could to the appropriate congressional subcommittee

Yes, most organizations are shy to release reports that make them look incompetent or highlight systemic problems. That's why we have laws that now require disclosure of incidents that may have exposed customer data.