I work for a big tech company, and part of our incident response procedure is to identify impacted users to send apology comms after cleaning everything up. Still, running those queries is a pain in the ass, so I understand why most companies don’t do that