Is there a breach notification list (somewhat similar to A CVE list) where companies can (anonymously at first) notify the world early and then publish technical post mortems.

Saying "76m records lost" is ok for headlines but like air traffic investigation we want to improve the whole system.