If they won't say, then one can assume patient data was stolen