When email-marketing firm Epsilon Data Management discovered in March that hackers had stolen consumer email addresses it maintains for major banks and retailers, Chief Executive Bryan Kennedy faced a choice: to disclose the breach or keep it under wraps.