Good on you for being up front and honest with the customers who were affected and for going the extra step and being willing to return funds. The offer is all that is needed for most businesses to see that you care about the product and their continued support.
In the U.S. years and years ago I read this same lesson from a small hospital surprisingly. They had a surgery go wrong, like amputated off the wrong limb IIRC, and admitted they screwed up directly and immediately to the family. They quickly paid compensation and didn't try to sneak in legal terms to prevent the family from suing. The family when interviewed said the main reason they didn't sue was that the hospital was up front, immediately tried to do what they could and didn't try to hide or sneak in terms preventing the family from suing etc. IIRC, the hospital also invited the family to sit in on meetings about steps they were taking to prevent similar mistakes from happening again.
The hospital you're describing sounds like a great example for others. It's great if you make it public, you also need to show you're taking actions on how to prevent it from happening (like they invite the family to their meetings). I do think the suing nature in the U.S. plays a part in people hiding their mistakes in for example healthcare.
Your hospital story makes me think of the book Black Box Thinking by Matthew Syed which I red a few years ago. It's about how different the approach is in the airplane sector versus the healthcare sector.
> Google did not tell its users about the security issue when it was found in March because it didn't appear that anyone had gained access to user information, and the company’s “Privacy & Data Protection Office” decided it was not legally required to report it, the search giant said in a blog post [2].
As the owner of Simple Analytics I think it's super important to build user trust. It's impossible to not make any mistakes so if a company never shared any mistakes, it's probably not telling you any.
Let's change this fellow hackers and share our mistakes. That's why I wrote a blog post on a mistake I made last week where I lost some user data. Some people would argue if it's smart, but I see this as a moment to show transparency.
[1] https://www.nytimes.com/2018/10/08/technology/google-plus-se...
[2] https://www.blog.google/technology/safety-security/project-s...
