Even if not marked.... if user know, or SHOULD Know.... it’s a violation
No direct evidence of hacking.... but, lack of protection makes is easy, and no evidence would be available..
they assess... it was POSSIBLE that she was hacked