Providing no information and no value is a very positive way to express it. They are just lying. They do know that they had inappropriate security, an attacker

Providing no information and no value is a very positive way to express it. They are just lying. They do know that they had inappropriate security, an attacker was able to steal data and they have taken the system down before other attackers can exploit the hole.