My problem with taking the second option is that it's highly unlikely anyone will do the research needed to determine the true cause of a hack. CYA for the company rather than encouraging better ...