Yes but that’s far less impactful of a breach than “we’ve actively surveilled and recorded all movements and actions of our customers for decade, stored it all haphazardly, and now someone else got it without paying for it like we normally arrange”