So - someone is lying. Isn't lying about the extent of a security breach a fairly serious matter? Blackboard operates in the EU. Is the disclosure portion of the GDPR retroactive?
Of course - I'm not making any presumptions about which of the two parties is a liar!