Good catch. I changed it around slightly in the markdown format to account for this:
https://github.com/rickmanelius/drupalpcicompliance/commit/5eff78b1006aa62bb0646b0c919b4881ecc7d4b6

Basically I ended up using "its security breach in November of that year".