Bye Bye beat me to it. I was also going to say that things like some sort of maintenance task on the system could have had some effect on data, intended or not.
So you’re making a huge leap from “some data has changed” to “someone has had unauthorized access to this data”, and then an even bigger one to “passwords have been accessed”.