That is my bad; I was thinking of LastPass[1] where it took them months to fully disclose and explain a very serious breach of data.

1Password seem to have a good transparency track record (I edited the original comment)

[1] https://news.ycombinator.com/item?id=34097142