While we did not divulge your certain information, we regret to tell you that your certain information was access in a hack that was discovered (9 months later).

if they intentionally or unintentionally were the source of that certain information, there's little recourse for you after the fact