That level and timeline of response tells you a great number of things, regardless of the source: 1) they had a plan for breaches (it would be hard to cover al

That level and timeline of response tells you a great number of things, regardless of the source: 1) they had a plan for breaches (it would be hard to cover all the ground without one) 2) they had technical controls/capability to respond (mass password reset) 3) they had clear and direct accountability all the way up to ceo Other than not having detected the breach, and using not-the-best (but not entirely the worst either) password storage, I don't know what else you could ask for.