it seems like they took reasonable steps after.

They acknowledged that it happened, fixed the bug that caused it, deleted all data that was uploaded.