Yes, I was responding to the apology. This should have been part of it, and is part of the lesson to founders. If you are in position of responsibility, mistakes are inevitable, and so is having to correctly apologize. (I learned the hard way.)
This incident is about a self-inflicted customer data breach. As it surprised the CEO, it suggests a full-company culture & governance issue, and is hard to be reactive about. Even when things are going well, customer responsibility & data protection should be a constant and non-obvious responsibility for everyone as soon as anything like marketing, sales, engineering, hiring, delegation, etc. gets interesting. A lot of people are involved in a major move like this and the governance structures that inform them. Think their VCs / VPs / managers / etc either signing off... or not caring.
And again, I'm writing this more as a warning for other founders. Building a culture is a constant marathon, and it's way harder to fix one. (For the CEO: I'd consult with a few folks knowledgeable about communicating apologies ASAP, esp. before any further unvetted public comms, and for longer-term, get regular external advisors + directly responsible internal leaders for fixing culture + security, and rethink why multiple internal leaders failed in both. But that's super generic.)