Re: Crucial point here, it doesn't become public knowledge. Hush, hush now.
"Does the ICO react to anything in 3 days?" It's up to you to inform within 3 days. After that it's up to them and nothing to do with you.
"Or ever?" Shall we have a check to find out? Oh, look https://www.theregister.co.uk/2018/01/10/carphone_warehouse_slapped_with_400k_fine_after_hack_exposed_3_meeellion_customers_data/