Such an action would result extraordinary liability for a company. Public discovery would likely lead to consumer lawsuits, shareholders suits, replacement of the CEO, and shuffling of the board of directors. Not to mention possible criminal/civil penalties that pierce the corporate veil.
Merely leaking it would be of no consequence. They could even do it directly as a blog post from their security team. Attempting blackmail would be the trouble.
Its not blackmail. All you have to do is to get people to think there's no difference and that everyone is bad (just like "all politicians are bad" and "all cable companies are bad"). Then you don't have to have good service at all.
