[wiether]

One of the usecases of Snowflake is to give access to a dataset to multiple teams in your company, while filtering what each team can see : https://www.snowflake.com/en/data-cloud/workloads/collaborat...

Service A can access the dataset with the location hidden while Service B can access the dataset with the timestamp hidden while Service C can access the full dataset.

So Snowflake probably has the full dataset, and the account that was used in the breach only had access to a part of it, where the timestamp was hidden.

It's hard to come to any conclusion about what was done with the data on this account.

We can even go as far as saying that the account never used the data but had access to it because it was part of a group of accounts with access to it.