The article you're commenting on says how they were compromised.

> The thing that works in their favor is that no one else can verify it either which absolves them from any responsibility

That's not how this works, at all. You need to have enough evidence that you can confidently demonstrate that there is no sign of a broader breach. If you get sued and can't do that, you're in trouble, because being unable to do that shows that you were acting negligently.