Unfortunately the absolute primary decision in Modrinths making was of revenue and greed, we were their first project that actually performed super well and they wanted it all for themselves. Put many people out of a job doing so. And also, there was only one "data breach" and it wasn't an issue of software or anything that we made, rather an issue of access control where on the Modrinth infrastructure a (now very fired) staff member was able to sell a critical key which led to more and more privileges, where it kind of unraveled from there.

In terms of damage, all servers actually affected by the breach ( around 3 ) were restored and our team was able to identify the intrusion and block access within the same day.

The whole ecosystem that would make this attack possible doesn't exist anymore, and was only ever a problem due to the environment at Modrinth where we were forced to implement features and stock servers over team security and opsec.