This is my primary concern with SaaS identity providers--yes, they are easy to setup and administrate, but they are huge honey pots.

In addition, customers are unable to do any forensic analysis to determine how their data was affected.

> OneLogin’s blog post includes no other details, aside from a reference to the company’s compliance page.

The only option is to hope they provide customers with relevant information in a "timely manner", but that could be months for an organization with thousands of customers.