Unfortunately "sensitive" has a specific meaning that they may be being legalistic with. PII, for example, is generally not "sensitive".
Willful ignorance. "No indication" meaning they haven't seen any evidence anything was compromised. Could be because they've been working very hard not to look at any evidence or analysis of what happened. "I'm not aware of X" is very different from "X is not true".
They probably don't have systems in place to even detect that data was snorkeled off.
So "no indication" is completely correct.
Well, "Sensitive" is the second lowest data label. It must all just be above that.
Except for all the leaked data, absolutely no data was leaked.
See the trick is to not consider your data sensitive, no SENSITIVE data was leaked.
There is no data leakage from the application where the front-fell-off, because we towed the data outside the environment.