I don't believe them
Our organization has over 300 users. 80 of them are part of our Sharefile workforce. All 80 have been getting a particular phishing email several times a day which began 4 days before Sharefile mysteriously began enforcing this new policy. The rest of our non-Sharefile users have received a single one. This is not a confidence. Whoever performed this hack were able to obtain a list of addresses. I don't know if they were able to get to any of our data. I believe the truth will come out.