I think that is pretty criminal already.

Basically:

1- Nord falsely blames its server provider.

2- Nord hides it from their users.

3- Nord claims all will be well with an “audit” (again, since they were already “audited”)

This is either criminal negligence, “security theater”, or both.