I suspect it is mentioned specifically because payment data falls under PCI regulations and thus adds response requirements.

So stating that such data was not leaked is meant to prevent that additional PCI response step.