The fact that companies are now starting to spot intrusions into their systems and identify the data, devices and configurations being targeted is a step in the right direction. Their disclosure reports also cant give too much info away because it gives insight into their setup, in much the same way GDPR requests give out metadata which can be used to search for attack vectors into a system.
In much the same way journalists can also phish information from those visiting certain news articles.