Most states have very strict reporting guidelines but in every jurisdiction, there are some valid reasons to delay releasing public notice. Typically, if the scope of a breach is still being determined and if releasing a public notice could accelerate an attackers plan, you can buy some reasonable time.
The beautiful part of all of this is the simple fact that “reasonable time” is left for interpretation by companies AND most states Attorney General.