I think that data breaches should be reported publicly as soon as they happen. That way customers can take early steps to protect themselves.

From the news reports, Citibank sat on this data breach for a month before reporting it. That's too long!