[bastard_op]

I've worked with/for a lot of org over the past few decades, and personal experience proves there are a _lot_ of incidents that go unreported.

The usual is that if there's no logs saying something bad actually happened, there's certainly nothing to say that it did, even though some terribly guessable credentials were used for ages on something publicly exposed. I know, they know, but told in no uncertain terms to drop it.

Nothing to see here, move along. Work to be done, money to be made.