They've already used the "breach" word in the original mailing. I don't see how they could sustain the notion that this was an external theft, cybersecurity requires better defences than were evidently present.