> If the data is off on another server, it seems unlikely that past cases can be compromised.

That isn't the point being made here. The data could have been compromised at the point of when it was gathered, not any time later.