Stupid move.

Messages send to telegram with the bot-api can be forwarded to anyone who has the chat_id and the bot token with the forwardMessage method. And the message id is an increasing number starting with 1.

So if they did not already disable (or got telegram to disable) the bot, they can now extract the infection id with the seed key.

tl;dr: All the information required to restore the data is accessible if you have the bot_token and chat_id.