"What we do know right now is that the alleged data breach affected about 0.5% ... "

They know that it affected some of their customers, but still call it "the alleged breach"?