auDA likely not hacked but not saying leaked data isn't genuine

Yesterday I wrote about a leak of internal data from Australia's domain admin, auDA. A few hours after I pushed send on that issue, they released a new statement saying that their "comprehensive investigation indicates that there is no evidence that cyber criminals have accessed auDA systems or have auDA data". They believe the breach came from an "Australian sole trader, with an Australian domain name" who refused to pay a ransom to the hacker. That hacker then tried to frame it as auDA's data and get auDA to pay a ransom instead. Doesn't change the fact that data on auDA employees is floating around the dark web, it just didn't come from auDA (or so they say).