That's an absolutely appalling response to an urgent data security situation.
I expect you had to provide a load of personal sensitive information via private message in this forum as well, how secure is that information? How long is it retained on the forum servers at risk of being hacked? Is there an effective security and deletion policy?
Virgin just appear to be reckless with personal data as far as I can see.
I had exactly the same issue as you, lots of people seem to be having this issue.
To raise a subject access request visit - https://www.virginmedia.com/help/dsar-faq with a heading highlighting an urgent GDPR issue, told them that my account was hacked and then emailed a day later when I hadn't had a response confirming I would sue them for any costs incurred as a result of the breach. After the second email they deactivated the account within hours.