Data breach notifications are telling victims less than ever. What the company leaves out can still shape what you do next.