The breach notification of course claims they have no knowledge of anyone doing that, but of course it leaves ambiguous whether that’s because (a) the logs that would tell them never existed, (b) the logs no longer exist because the exposure lasted three years, or (c) the logs exist and they checked them and found no malfeasance.
2/3