A fresh victim page has put Bath Fitter in the frame, but the employee-data allegation remains unverified and the technical path is still unclear.