Sounds awful. I'm so sorry this happened to your son.
So, if I understand you correctly, the staff informed you of the incident, but did not give you the requested incident report? At least you have a letter from the director documenting what occurred. I know it's not what you wanted, but at least you have a dated acknowledgement from the center that your child was unsupervised. That's something.
I agree with you that children should be supervised no matter what age. Did you report any of this to the agency in your state that licenses day care facilities? If not, was there a reason why? If you did, is there a case number or a contact that you had there? I'm not sure if there's a requirement for a bachelor's degree in your state - and there would be different requirements for the director than for individual teachers. But if you're going to pursue this, it matters less what your opinion is on educational minimums and much more what the state licensing agency requires. So focus on that.
How old are the children involved? Is this regular day car for preschool, or is it a before-school or after-school day care for older kids? The reason I ask is that there are different staff-to-child ratios depending on the ages of the children (but leaving them alone wouldn't be an option anyway), but also that it's likely not wise to use the term "gang" when referring to young children. It's less likely that a group of 3 preschoolers would plot an attack like this, although they may be running around undisciplined and certainly could hurt someone even if what they thought they were doing was "rough housing" - which I'm not excusing at all, just trying to clarify. So the language you use should reflect the appropriate stage of child development.
I guess I would start with the licensing agency and make a report, if it wasn't done at the time. Given the time elapsed, you will have to prove that your child sustained injuries then and also that there have been continued changes in him. You'll need medical records for any check-ups or calls to the pediatrician at that time, as well as any medical or psychological follow-ups. Gather all the paperwork, and write up a diary/journal of what happened with exact dates (or approximate ones), a list of the people with whom you spoke, etc. Make copies and do not turn over your only copy to anyone! Keep a set of everything for yourself. If you have to write up a complaint or a report, have a trusted friend who is terrific with grammar and spelling go over it just to catch errors that you don't see when you're the writer and also the person who is upset. If someone is really objective, they can help you weed out any comments that don't belong, even if they are points you may need to make down the line. (For example, if it's not required that someone have a degree, don't complain about that, because the agency may take it as a criticism of their own standards. Besides, it's not like a degree is necessary to keep an eye on kids - and that's what your argument should be. Same with chronic understaffing.)
If you had costs involved in moving your child to another facility, note those as well. If you did not move your child/children, be prepared that you will be asked why not. Day care is hard to find, and I get that. But be prepared with a calm and logical answer to that.
You could certainly have a consultation with an attorney to see if you have a case. Usually those are free for 1 hour. Do you have a lawyer for anything else (family law, real estate, etc.)? If so, start there and ask for a referral. If not, talk to people in your area whom you respect and who will maintain your confidentiality, and ask for a referral. You can use your local bar association too. I wouldn't advise going to anyone who just advertises on TV unless you also have a referral from a respected friend/acquaintance/professional.
I would say you should not discuss this with the day care center director at this point until you have a plan in place with some expert advice.