[d23]

> "He did not access customer content," Pelanne told Ars. "We caught it well before he had any chance to do any of that."

> Given the rapid discovery, the malware was on Hostgator systems for less than a month.

Then yes, he did. If the malware was on there for more than a few days, I find it extremely unlikely that at least some data wasn't compromised.