At least the statement is not competently written.

They write that TLS certificates have potentially be exposed. That doesn't make sense. TLS certifcates are public. Probably they mean private server keys have been potentially be exposed. And after that the certificates are not only useless but dangerous (if the private is really in the hands of the attacker).

They write they have been revoked, OK. But they continue to be served until new ones are in place. Hmm? Well, no browser checks revocation anyway I guess.