"As a result of the breach, all user permissions were reset, making all profiles visible to all users. This was the case for approximately 3 hours.

... No user data was downloaded or compromised."

I find the second statement hard to swallow.