Yes, but if after two months they’d found out that customer data had been compromised, that would be a little late for me to do anything about it.
My concern was mostly around the situation where you believe it had not been, but it had.
What I’d expect is a note on the 24th that they’d kicked a threat actor of their Jira system, and that they had no reason to believe the rest of their systems were compromised, but that they were taking action to prevent it from happening again and starting a full investigation.
I get that the business might not want to do that if they are not certain there is any cause for alarm. Uncertainty might be even worse for some.