Probably someone leaking from the inside due to money/incompetence? That makes their PR go worst though. There's a myriad of scenarios.

They can only be upfront and show how well they respond to the situation including mitigating future security issues.