The following was posted on Macrumors. Definitely not a perfect user-first response from Apple, but didn't seem terrible either. Particularly because Apple wasn't the source of the issue, the issue was people downloading an unofficial XCode tool not made or hosted by Apple. Apple discovered it (just like many researchers did) and made various (non-perfect) efforts to mitigate it. And according to Macrumors, the attack did not really lead to any serious consequences. Not sure if that's true but I haven't seen any evidence to the contrary either.
> Apple did ultimately inform users that downloaded XcodeGhost apps, and also published a list of the top 25 most popular apps that were compromised. Apple removed all of the infected apps from the App Store , and provided information to developers to help them validate Xcode going forward.
> XcodeGhost was a widespread attack, but it was not effective or dangerous. At the time, Apple said that it had no information to suggest that the malware was ever used for any malicious purpose nor that sensitive personal data was stolen, but it did collect app bundle identifiers, network details, and device names and types.