VPN provider insists no user data was compromised in a March 2018 server breach, and says its datacentre provider failed to inform it of the issue