Well, I'll put it this way. That is a lot of data to track, in fairness, if I'm looking at it from the cybersecurity point of view. I can't tell you if they had the data or not; it all depends on how much they archive.
To be plain, I fully believe your victim. This is a company that I strongly believe has some heavy liability out there and should face consequences for it.