Depends on how they break your system. If it's by a well known 0day I would think you should secure your systems and give public notice. If it's by a unknown me

Depends on how they break your system. If it's by a well known 0day I would think you should secure your systems and give public notice. If it's by a unknown method and you trace it through a piece of software i'm not too sure. Many vendors like Oracle have a horrible track record of patching vulnerabilities until they become public. I believe California requires notice within 30 days if it affects any California users.