The RSA has finally admitted that their SecurID token has been compromised. Should they have given customers this information or would revealing this information have increased the risk of attack?

What do you think?