This and similar PR nightmares show how little smaller companies understand PR and the right way to handle these situations. Responses should be apologetic and serious in tone, even when the customer was not completely in the right (but is perceived that way by the public). They should clearly state the corrective actions taken. Regarding the employee in question, you can defend the person, but be careful how you address their actions. The corrective action for that employee should go way beyond "that naughty boy won't get to talk with customers any more, ha ha!" The public perceives you have an unstable employee with power over their data (read: livelihood), so counseling/training at minimum (if you don't think the lost business is grounds for termination; probably easy to estimate that, and a smart mgmt. team will do that).

And - holy cow! - you don't have a customer service rep writing the response, you have the CEO or owner do it. That it wasn't goes back to my original point - they don't (yet) recognize this as a PR disaster.