The tweets and statements to The Intercept back in November seem to imply that there was an incident covered by the canary statement that they aren't allowed to talk about, but ruled out "a NSL, a FISA order/directive, or any other national security order/directive, foreign or domestic". Optimistically, perhaps they had to turn over some encrypted data to a criminal (non-political) investigation. Hopefully more information comes sooner rather than later.