After they've already been shown to have been dishonest previously, and after they chose to make an additional disclosure on the last working day (for most) before Christmas, I think you have to assume your data is at risk, and act accordingly. I certainly would.

Do you trust them to tell the truth about whether all your data was reliably, securely, and permanently deleted? Can they tell you when and how?