You mean he should have told those affected without knowing what actually was leaked, the scope and impact of the leak, and the whereabout of the leaked data, or making sure there is enough safeguard in place so no one can repeat the same attack? Does not sound more responsible?

The keyword is responsible disclosure, not just disclosure.