‘Logs do not indicate hackers access any sensitive data, because we did not implement logging and did not look very hard for auxiliary evidence’