I appreciate the level of detail that PagerDuty went into with this announcement.

I presume they wanted to have all of the facts before they notified customers, but it is totally unacceptable that they waited 3 weeks to notify me about an incident with confirmed external intrusion and confirmed theft of customer data (including my own).