The state bar, which now says the breach was the result of a security flaw, not a hack, concedes officials with the agency never contacted law enforcement as they originally claimed.