> When asked, the department said that it has identified “no sign of exploitation prior to this breach"

As long as you do not look, you will not find.