Should companies affected by ransomware be mandated to disclose incidents?

Should companies affected by ransomware be required to disclose incidents? Distinguish information affected people need from details still under investigation. When and how much should be disclosed? Consider explanations that do not undermine the response and later corrections when choosing the scope of duties for all incidents or major cases.