It does not mean SQL injection is rare. It means the disclosure regime records who was affected and not how.
Four business days from a materiality determination the company itself makes. The clock and the investigation run on incompatible timescales.