At any point, any company and individual is in the state of "We have no evidence that your application data was accessed." I get what you're trying to say, full verification is tricky, and there's nothing wrong with rotating credentials just in case in those situations. But you're implying way more than that and there's no reason for it.

This. If they had the data access logs enabled, they would've been able to confirm whether or not the data was accessed.