We have observed the horse has bolted, oops, our bad.
"Through routine and proactive web scanning, we recently discovered information related to your jcrew.com account," customers are being told.
So, they do not routinely and proactively review their own network security. But, all is good they can detect a data breach by way of the intertubes. I wonder, do they use the security tech of a google or bing search?