It seems like the breach was through a third party that only had old data, since nobody that registered after April 5, 2018 is affected.

So it's probably some service that they no longer use and doesn't really need to be fixed or investigated, since all the data they had has already been taken and they (probably) stopped giving them more data a year and a half ago.

They should really say who the third party was though. Hopefully that information comes out.