Let me guess: they're really sorry.
I cannot fathom why such data breaches aren't prosecuted as crimes of the company as well as the thieves.
This doesn't happen because the hackers struck like a force of nature, but because the servers aren't kept secure constantly. Because that would be more expensive.
It's like a car company getting sued for making insecure cars. It's not hard to wrap your head around.