I see. So your skepticism is not so much that the agents are incapable of figuring things out, but that HF would have blocked any suspicious activity.

I can't really refute that. There are many small and medium businesses that I know are susceptible to very basic attacks but I don't know enough about HF to guess how hardened their security is.