At any point, any company and individual is in the state of "We have no evidence that your application data was accessed." I get what you're trying to say, full verification is tricky, and there's nothing wrong with rotating credentials just in case in those situations. But you're implying way more than that and there's no reason for it.
Translation: We don't know how we were hacked and can't tell what anyone did or didn't look at.
In that case I would treat it as full compromise and urge everyone who might be potentially affected to change password, rotate keys, whatever you need to do to protect yourself.