I personally believe that this incident is already very widely publicized....

This is precisely why I asked about the legal ramifications in 784719. Specifically, are there any applicable state or federal laws that require notification? Establish what you have to do (or what your lawyers advise you to do) first before worrying about what you would like to do.

Update: And if possible, after things have settled down let us know what the response was. This is a great opportunity to learn more about the legal side of security breaches like this, especially for open source foundations, organizations, etc.