> "We have no evidence that the criminal actors have used this data to commit identity theft or account fraud." I see this type of message on so many statement

> "We have no evidence that the criminal actors have used this data to commit identity theft or account fraud." I see this type of message on so many statements about breaches. It seems like one of those things that can be said even when the potential usage in question would be extremely likely, because even if every marketplace for this stuff is advertising "identities stolen from MGM" for sale, that alone isn't "evidence" that it's actually what it says on the tin. If someone purchased it and showed their purchase to MGM, would that be sufficient "evidence" for them to not make such a statement?