This is how most initial disclosures go, then a few weeks on the third-party security firm investigating notifies them they got completely pwned.