This is very sad to hear. More so for the owners of raided coins.
If there was a leak of private keys somewhere in the production process the manufacturer should know the name of the people involved.
So if an investigation is ongoing no much info can be publicly released. Over time hope some names surface, we know who did it in Coinographic's case.
Richard was apparently the only one with access to private keys, so he stole them himself, or he is flat out lying.
One other possibility is that he
thought he was the only one to ever see the private keys but someone else got a copy of (some of) them.
They did have a lot of people on their failed "risk management" committee/team.
But how is that possible? He claimed he created the private keys himself, then engraving coins and destroyed the private keys. It's a pretty simple process.