Question. I am curious in general in that, how can they say that "this" data was compromised, but "that" data was not? How does that work? Do they really have

Question. I am curious in general in that, how can they say that "this" data was compromised, but "that" data was not? How does that work? Do they really have some low-level access log that shows who accessed what file and at what time? And then, do they keep that log for some months at least? And, can they query that log and declare that, six months ago, "this" data was compromised, but "that" data was not? How does all that work.