A hash-like string and a named institution are enough to trigger scrutiny, but not enough to prove a breach.