Not 'helping them', just diagnosing a breach. Part of their due diligence to make sure they don't run afoul of the reporting laws. Once it was determined they

Not 'helping them', just diagnosing a breach. Part of their due diligence to make sure they don't run afoul of the reporting laws. Once it was determined they didn't have proof of data leaving the network, I imagine they booted that security company immediately. They're not going to spend money to improve their security just because a non-reportable breach occurred. They don't give a shit about your data.