Should Companies Be Required to Disclose Cyber Attacks?