This is an interesting response, because it reveals a few things:

- Linkedin was not aware of the size of the 2012 breach.

- Linkedin did not use preventive measures one would usually do after a significant breach (They only now issued a password reset for accounts older than 2012).

It seems like they also botched the 2012 post-hack evaluation.

I wonder if their security engineer(s) could be held personally liable. Someone has advertised him/herself as a security engineer, while completely botching the password scheme (unsalted Sha-1), and leaving massive holes in the post-evaluation of the breach.