6 weeks really isn't a long time. They had to locate a pentesting firm that specializes in forensic investigation, schedule it, conduct it, then decide what to do.

I know it's an unpopular opinion. But both Uber and Equifax took similar amounts of time.