I believe they mean they removed the data, which was unused, from their own website.

Yeah, seems kind of obvious thats what they meant.

I cannot understand why they didnt say "removed from our servers" rather than "removed from the internet" though, seems almost intentionally misleading.

> why they didnt say "removed from our servers" rather than "removed from the internet"

The data is on servers "not on the Internet"?

There's no way OWASP don't know the difference between "the [entire] Internet" and "our website". I believe their intentions are to tone down the fear that people may have. It's gaslighting.

This. I was like "do you believe it in your head?"

What action should one do ?

Panic and/or complain loudly, I guess? You can't fix a data breach after the fact, which is why organizations need some sort of pressure to take preventative measures.