Comment by chrisjj

It can be both.

Data was exposed but not taken.

Or data was taken but investigations failed to show that.