Their official security incident report: https://www.elementary-data.com/post/security-incident-repor...