this seemed like a bug bounty from the beginning, and the media was disingenuous to spin it like blackmail.

if there was no evidence that any data was actually compromised, I'm not sure I see a reason why they would need to disclose this to the public.