Right.
In this case, they didn't. They literally just prepared a damage control plan and didn't inform Canadians, whose personal information was being used for the ill-gotten financial gains of fraudsters and criminals.
Isn't there an ethical and a moral obligation for a minister, acting on behalf of the Crown, to inform Canadians?