A competent security response to this would have been "Yes, they compromised one of our support technicians. We've initiated an audit and are sending out e-mail

A competent security response to this would have been "Yes, they compromised one of our support technicians. We've initiated an audit and are sending out e-mails containing all of the actions that support representative performed for each customer to that customer's administrator"