No, I’m saying that if they’d found out after the fact that it had, it could have been bad for me.
What I’d expect is a note on the 24th that they’d kicked a threat actor of their Jira system, and that they had no reason to believe the rest of their systems were compromised, but that they were taking action to prevent it from happening again and starting a full investigation.
I get that the business might not want to do that if they are not certain there is any cause for alarm. Uncertainty might be even worse for some.
