I've had stuff like this happen too, and always wondered if they really leaked my data or were just notifying everyone whose data they possibly leaked.
I think the argument is "if they didn't retain your data, it couldn't have possibly leaked"
I think the argument is "if they didn't retain your data, it couldn't have possibly leaked"