I agree there should be real people (founders, c-levels, engineering managers, etc) taking responsibility for things like this. Another place to look at is the

I agree there should be real people (founders, c-levels, engineering managers, etc) taking responsibility for things like this. Another place to look at is the insurance companies who sell cyber liability policies to basically all (even small) tech companies. Those policies provide near full coverage for the most expensive parts of breaches like these (including a set dollar value, often $100-200k in policies I've seen, to hire a PR firm to recover from the media fallout). These policies are often surprisingly cheap (you can get very good coverage for $10k / year) Edit: A common complaint with these type of announcements is the lack of owning the mistake. Just wanted to point out that this is almost certainly a result of the company contact their insurance carrier about the incident, and the insurance carrier instructing the company how to respond to the event (in order to remain eligible for benefits under the policy). It’s not a great excuse, but there is a reason that’s slightly outside the control of management.