If one service was compromised, isn't it reasonable to think that the scammer can access other services during this breach?