Sadly the universe isn't fair.

Nobody gives a shit about security, but yeah it should be illegal to sit on the information more than 48 hours. If you can't determine the complete and full extend of the damage before that you need to be out of business.

It could be a bad idea to let intruders know you're on to them if you haven't determined the extent of the intrusion.