Some thoughts: "Once we recognized that there had been a data security incident, Timehop's CEO and COO contacted the Board of Directors and company technical a

Some thoughts: "Once we recognized that there had been a data security incident, Timehop's CEO and COO contacted the Board of Directors and company technical advisors; informed federal law enforcement officials; and retained the services of a cyber security incident response company, a cyber security threat intelligence company; and a crisis communications company." - Good response! Don't try and do everything yourself. Pay someone to handle the important response stuff that you're not an expert on. "We have no evidence that any accounts were accessed without authorization." - Not so good: this just means they didn't see accounts being accessed. It may be more truthful to say "we have no way of knowing that someone did not access them."