[ryandrake]

The criticism is of the emptiness of the PR-written responses. A few people at a company being "pretty upset" about a security breach doesn't mean the company actually takes security seriously. Responses like this are fairly obviously canned and insincere, and are designed to deflect criticism of companies' actual security practices.