Fair point, I can't edit my comment. My metric though is this: Someone has admin level access to full root on control plane and does things to customer account

Fair point, I can't edit my comment. My metric though is this: Someone has admin level access to full root on control plane and does things to customer accounts they don't want. A customer complains that the control plane has been used to reset things / asks for logs / etc. That's your opportunity to identify a root level control plane hack, disclose it, do the password reset things, remediate and move forward. OR - You don't disclose things till much later, you deny things, you provide scrubbed logs. Add in the bitcoin angle where this type of story is pretty common (trusted entity runs away with coins because they are easy to steal) - and couple that with how they handled the reports -> as I said in my comment, I'd be careful putting sensitive info onto that platform.