Agree, QF may be able to claim it wasn't an "incident" because in their eyes it did not compromise their business (in a hackers eyes, their business definitely had points where it was compromised)...... but the focus in their wording "there is no evidence of a cyber....." was clearly to draw the reader to conclude this was not "cyber" related (as there was no "evidence").....and correspondingly their average customer would also read this as not security related..... when it was both cyber related and security related.
If QF's intent was to highlight that this was only an "event" and not an "incident"...... then in terms of this breach of my data, QF are not treating it as significantly as they should (if QF are just trivialising this as an event an not an incident)...... and maybe that is why they stopped any further investigation into how this happened...... and why it could happen again......