SafePal (hardware wallet) had a breach and says it's not their responsibility

To make a long story short, I bought two SafePal S1 Wallets last year. Yesterday I got a call from a person claiming to be from SafePal. At first, I denied having purchased any SafePal products before, assuming it's a scam. Then, they told me my full name and home address and my exact order details. They knew how many and which products I bought and the exact payment method I used.

Upon checking my email, I saw that they had sent an email outlining details to update my firmware as well. That email, too, included my exact order information and home address.

When I asked SafePal about whether or not they had been made aware of any breach, they simply said that they're not responsible for such issues because "as a decentralized wallet", they don't store any data and that it "may have been because of a partner having been compromised).
I was like, is this a joke? How can they not store data when they take physical orders and payments through their own entity, SafePal LTD??

It is completely unacceptable and unprofessional for a hardware wallet company to not take any kind of responsibility for their customers' entire data being exposed.

They didn't even inform any users even after I made it clear to them multiple times that potentially thousands of customers' data had been compromised. This is complete and utter negligence.

Never buy SafePal products.