It is a good statement, and I believe they'll follow through, but it's missing something important that is often missing from otherwise professional communication.

The last line is "We will report our findings back to the community as soon as practical." It should be followed by "and we will provide an update in no more than 30 days".

Without any explicit time frame, holding them publicly accountable becomes trickier. At any point they can just say "we're still investigating" until enough time has passed people aren't paying attention any more.

Note that the companies that do ongoing incident updates on status sites best all do this -- "We will provide an update by 10:30pm PST".