The real genius in the announcement is, "data hosted by a third party provider". Absolutely irrelevant, but subtly implying that the error was the fault of a third party.

That will be the new norm in these kinds of annoucements, I'm sure.

Just like SolarWinds dropping "Team City", saying "no evidence" of a breach of it. So why mention it at all?