It's not up to me as a reader to prove whether they are lying or not. As a writer you either have integrity and assume your audience is knowledgeable and skeptical of unverifiable claims or you can exploit the fact that they aren't. There is a clear line between good writing and not.
I'm not assuming they're lying but they've given me no reason to trust that they aren't.
But lets be clear, they explained nothing and hand waved around what they did.
In an article that is indirectly about bugs in software, I want to be sure that the "simple" methodology doesn't have bugs. This is easily shown by the author by just providing the scripts and methods they used. Choosing not to is lazy.
Here's some simple questions that that "sourced" passage doesn't answer.
1. Where/how exactly did you get the info from the CA Attorney General?
I searched and found this https://oag.ca.gov/privacy/databreach/list which extends back to 2012. Did you just download and parse the PDFs because some have two notifications listed, some have one. Some could probably have more. Are they counted as one entity or multiple?
2. "Stitched them together" Well that can just mean anything. Considering that PDF Parsing is still seen to be painful to most (https://stackoverflow.com/questions/22675690/if-identifying-...) there are errors that can be introduced here.
3. How did you handle string repetitions in the same document? If I put "We take your privacy seriously" at the start and the end, is that n = 1 or n = 2?
4. Assuming that 285 (of 1559 line entries) of the ones you parsed are single line entries (That sometimes contain multiple breaches and notifications) the author stopped at the 20th of January 2018 for some reason.... Why then?
I could go on and yes these are pretty pedantic questions. None of which are design to accusatory or suggest anything untoward about the author and what they wrote.
But you know what, all of this is answerable if they post their source and their source code. I can take a look and get a better picture of the full-arsed or half-arsed effort that went in to this article. (Sometimes half-arsed is okay, sometimes it's not)
If a tech website can't "do better than what [I]sic just quoted", then I circle back to the initial statement.
"Man does it represent the piss poor state of Tech writers and their articles."