What happened in the recent data incident involving less than 200 Shopify merchants?

Is the reason you can’t ID merchants due to contractual privacy issues with them? I’m writing a blog post about this and I want to be accurate. Thanks!!!