Firing someone because of the criminal activity of someone else seems very weird.
At least he is opening himself up to that interpretation. Maybe the “consequences” are just disgruntled customers deciding to take their business elsewhere or the loss in trust in her, resulting in a reduced ability of her to do her job effectively, but in that context also talking about the “130,000 valued customers” is very weird. I can only assume that he was at least also referring to the DDoS when talking about the consequences.
To me it’s pretty clear that if the DDoS played any role in their decision, then it’s at least partly based on immoral cowardice.