I think this was big enough that they had to comment. Publicly leaked personal information might be enough to start a lawsuit (IANAL). But I agree, props to them for going against their SOP, and actually communicating.