A public Qilin victim listing naming Misericórdia de Santo Tirso is a warning sign, but not proof of breach - and that distinction matters for both incident response and legal exposure.