I believe Paul has addressed again in his press interviews for F10 release.
It's an ongoing investigation and he's on record as saying he's committed to making a full disclosure when its possible to do so.
I specifically declined to be told about details of the breach if it meant that I would be subject to the same disclosure constraints which would prevent me from talking publicly. It wouldn't really help to have yet another person who couldn't talk, unless you are one of the people who are tired of hearing me talk.
I have trust in the people who are privy to more details than myself such as Paul. And no, I have no idea how long this sort of investigation is expected to take. When Paul can make a disclosure, I'm going to be right up front asking pointed questions about the investigation.
But this does remind me, we did have a discussion about communicating an incident response plan for future issues. I should ping people about that.