> but that doesn't mean it wasn't, or even that evidence doesn't exist - right? That is how it works. You can't prove a negative, so the data is not compromise

> but that doesn't mean it wasn't, or even that evidence doesn't exist - right? That is how it works. You can't prove a negative, so the data is not compromised until the investigation shows that it is. The developer's credentials was compromised, but those credentials don't give access to the production databases where customer data is stored, then there is a good reason to assume no customer data was breached. Of course you still do due diligence and investigate anyway, just to be 110% sure.