They hired an investigator? Any investigator worth a shit is gonna say that they're liable for failing to secure private data they collected, as well as for retaining data they were apparently legally obligated to delete
Edit: Misread that segment, they actually presented it as if they were deleted to users, but apparently retained them to comply with vague "law enforcement requirements."
1 week free access to the service that did it in the first place is my favorite class action outcome.