I would say that one can only speak of a breach if data from this has reached people that shouldn't have it.