[chrisjj]

It can be both.

Data was exposed but not taken.

Or data was taken but investigations failed to show that.

[some-human]

But surely if it was exposed they have to assume it was taken?

If you can view the data then you could have saved it locally, print it or screenshot it, even write it down with a notepad and pen.

For all intents and purposes if they've accessed it, they've taken it?

[chrisjj]

They may indeed assume it was taken, but that's not inconsistent with your report extract.