It sometimes takes months for these companies to come up with a full public statement on any privacy scandal. The process of getting hold of the people with enough clearance to be able to deny alone takes time. Let alone ensure that the statement is approved by senior management and legal.
Usually the best statement you can get within 24 hours is "we're taking these allegations very seriously and are looking into it".
This very much feels like a scripted response to an anticipated scenario.