Right, it depends who was compromised. My statement accounted for the fact that Apple has access to so much personal information (icloud, siri, app store, all c

Right, it depends who was compromised. My statement accounted for the fact that Apple has access to so much personal information (icloud, siri, app store, all customer service functions, applecare, etc). But it's true that they have many employees who have no such access and would not trigger the California law. Generally the attacks are fuzzy. The attackers are quick to pivot off of the first infected system, because defenses tend to be extremely weak inside the firewall. They look for test systems, code repos, privileged interfaces, etc. For this reason, if they can't reasonably say that the compromise didn't lead anywhere else, they could get in a lot of trouble for failing to disclose. Remember Sony? They kept quiet and attributed billions in losses to that incident, and had regulators down their backs. Nobody wants to deal with that. If the details of the compromise are not thoroughly understood internally, it could be better to say what happened and note that you don't believe user data was compromised.