[rezonant]

Your options are: (A) Vendor waits until all the facts are in place and the investigation is finished or (B) Vendor tells customers as early as practical so they can take their own mitigation steps.

You do not have the option of (C) Vendor should tell me about a breach they don't yet know about.