Most likely, they cannot help much, because they do not keep information about their users, nor ask for KYC. If they would act differently, it would be contrary to the fact that they have presented themselves as a no-tracking service until now.
Also, using an Exch exchange, the user can delete all data immediately after the trade. Someone who hacked 26+ million is certainly aware of such an option.