"we welcome this opportunity to learn the lessons from this criminal cyber-attack in order for all businesses to better protect consumers in the future."
There seems to be an implicit message that this was a big mystery. How on Earth did such a thing happen?
They know perfectly well. They left themselves unsecured. They shouldn't have needed to learn anything. They should have kept on top of securing things. The only way they'll really learn anything is to be handled penalties by every regulator in sight to the point where they can't pay management salaries let alone bonuses.