This should come as no surprise. For any major breach that is publicized you can be assured that at least 5 others were suppressed. And any contract given to an outside Breach team called in will have substantial penalties for disclosure.