Shit happens. WPEngine owned it. Took action and notified customers. Perfect example of an honest transparent execution of putting customers first even if it means inconveniencing customers. Well done WPEngine - I have even more respect for you now then I already had before. Whether or not an actual security breach occurred is secondary to the possibility that a security breach did occur - to assume that the worst possible case scenario has occurred is always going to be the safest approach to take.