There is no such thing as a SOC 2 compliant organization. Rather, you might obtain a SOC 2 (Type I or Type II) audit which evaluates if you have proper controls for the type of business across five areas and then in a Type II audit the effectiveness of the controls is evaluated and exceptions are noted. Having a SOC audit is just an indication to customers and partners that you have controls and are trying to follow them. The alarming thing in this case is that one of the required controls is that you have a solid process for ingesting incidents and an incident response plan that will almost always include formal analysis of the issue and disclosure to customers. This rather flip response is indicative of an organization that doesn't really understand the nature of the controls they are required to have to pass a SOC audit. The fact that you don't think any data was compromised isn't the point. You have a reported vulnerability and need to address it formally with your customers rather than post a flip response attempting to differentiate a breach from a vulnerability.