The CTO just said the truth. How else would he say that the customer's data will be deleted? Sure it was straight up blunt, but I think he was just speaking casually.
Since the software version no longer works, they wouldn't be able to do a restore anyway. Keeping their old data on the live servers longer could be a liability.
(just a guess, but i imagine it's something along these lines)
The Backblaze software doesn't handle restores, it just backs things up. To restore, you download zip files of selected folders from the website.
I agree that a better solution would have been to remove the backup to a secondary system that the client could later access if needed.
Deleting in 7 days is unreasonable.
I want to like Backblaze I love their harddrive report but this is not helping.
It wouldn't have been unreasonable to move away from SHA1 in that time period, for example. They may have needed the original files to get a SHA256 hash.
I think it must have been blocking some organizational objective. I can't think of any reason why they would bother to send that email, much less to go all the way to the CTO to send that email.