"In cases where an account was taken over by the attacker, they may have been able to view additional information"

They say it but downplay it very much.

Obviously this means the attackers had access to DMs.