After insisting for days that victims had simply fallen for phishing attacks, the platform’s CEO said he is “sorry that this has gotten so far.”