A named domain, a posted hash, and no verified impact - enough to flag risk, not enough to call a breach.