It says "customers were impacted" and that they had to work to "eradicate unauthorized access"

It's just a very weazel-worded disclosure. Most definitely a breach.