Originally Posted by bisonrav

Well possibly, but that doesn't mean they won't set up the best defensive position they can. Which precludes saying "it was our fault, have some compensation".

It is certainly the case they were the victim of a criminal attack, that's self-evident. It appears that a script was modified and then made live, which suggests poor access control. However were the access to have been granted by an insider, that would be arguably outside their control (and a criminal act). If it was using a backdoor or policies on user identification and review were inadequate or not followed, that would be arguably within their control.

It's not clear cut because we don't have the details, but what is certain is that their actions and communications now are completely constrained on legal advice. However frustrating that may be for individuals, you will not get past the agreed wordings. It may be a couple of years before anything much happens.