3 days seems like a long time to alert people. Releasing the news early would be the right thing to do but keeping it secret until you know the extent of the breach was probably better for their brand.