If they accessed personal information through an API, I'd expect an access log (if reviewed quickly enough because log rotation) to allow for some idea of compromise. If they got into a database, I would be surprised any queries were logged (with their result sets) to figure out what is exposed.
Slave to the Patriarchy no more