Hackers don't always leave a calling card letting the victim know that they have stolen personal data.  System and log files can be manipulated and, depending on the skills of the investigator, specific indications of access are often missed.  For the University to simply assume that nothing was stolen without any conclusive digital forensic evidence to support that conclusion, it seems quite a stretch to simply tell the potential victims in this situation that nothing was stolen.  Seems like the better conclusion would be to assume that the personal data -was- in fact stolen and to advise potential victims to take appropriate precautions and measures in this instance as well as going forward.  It sounds like the letters to the potential victims address this, but ADN did not share the content of the letter or perhaps was not provided with it.