That should depend on whether they informed the affected customers that their data was leaked in a breach or (if they weren't yet aware of the breach) how they

That should depend on whether they informed the affected customers that their data was leaked in a breach or (if they weren't yet aware of the breach) how they react to the news that they have been breached.