Is the identity of the breached third party public knowledge? Is there a way for other startups to determine if they may be at risk as well? If it has that many high-profile clients it is likely a popular service.