Posted about it earlier today: https://news.ycombinator.com/item?id=50436636

but good that they finally got around to posting something official ...

I asked the CISO if they can tell me if the data was accessed but they aren't answering and any communication is super slippy like "may have been accessed". I need to do some GDPR notations bc of them but I won't start running around just bc it "may have been" accessed