It's probably too early to know for sure, but do 'we' know that it was just data taken, not data modified / added?

I really hope they take proper measures to quarantine, re-validate, etc.