Atlassian decides which vendors they use and which vendors have access to their data. It's Atlassian's responsibility to protect the data that they have and to make sure that anyone they share that data with is taking similar steps. This is Atlassian's failure, their fault, and their responsibility. Hopefully they are right and no customer data was at risk.