They deserve an award
They deserve an award "Best reaction of 2017 to a security breach" or something. I realise there's still a lot more year to go, but recognising their efforts may inspire others to improve too.
Before you say "but they got breached": yes, I know, but you should consider that possible for ANY setup, however sophisticated. That's what proper risk management is about.