They hired an investigator? Any investigator worth a shit is gonna say that they're liable for failing to secure private data they collected, as well as for retaining data they were apparently legally obligated to delete

Edit: Misread that segment, they actually presented it as if they were deleted to users, but apparently retained them to comply with vague "law enforcement requirements."