Companies are afraid to talk about cyber-attacks. They need to be shamed into doing so