In reply to David Artiss.
“A security breach should always be discussed in private until confirmed.”

In times of GDPR this is not always true as there are regulation if personal data is affected (which is the case here).