I'd like the specifics in writing, focusing on why the people whose information was breached couldn't have been notified earlier. Those people are all at risk, and you have a duty to notify them at the earliest possible moment.