> We have no evidence that your application data was accessed.

Translation: We don't know how we were hacked and can't tell what anyone did or didn't look at.

In that case I would treat it as full compromise and urge everyone who might be potentially affected to change password, rotate keys, whatever you need to do to protect yourself.

At any point, any company and individual is in the state of "We have no evidence that your application data was accessed." I get what you're trying to say, full verification is tricky, and there's nothing wrong with rotating credentials just in case in those situations. But you're implying way more than that and there's no reason for it.

This. If they had the data access logs enabled, they would've been able to confirm whether or not the data was accessed.