which they handled about as well as you can: prompt and clear notification without trying to pass the buck
the potential of a data breach is just a fact of life with any SAAS product - bugs happen… and it’s exactly the SAAS part of the product that makes the invites/login/aggregation of servers so smooth