It’s a reasonable possibility, it’s also a reasonable possibility that nobody did.

But somebody incidentally seeing them, and maybe, maybe not recognising they were passwords is not a breach. Somebody intentionally misusing them would be, and I haven’t seen anything to suggest there’s a reasonable expectation that that occurred.

A reasonable expectation is also not the standard of proof I’d generally like to see from a government attempting to enforce a penalty.