Not necessarily. If that were the case, wouldn&#x27;t they use the stronger, &quot;and we have evidence that no data was accessed through this exploit&quot;? The fact is: They can&#x27;t possibly protect user data once the private SSL keys leak. At that point <i>anyone</i> can intercept user data on third-party, non-Facebook servers if they&#x27;re affiliated with an ISP, wifi hotspot or other point of access. Anyone could send targeted phishing emails for their servers: How would they know, if the SSL cert looks legit and the DNS is regionally poisoned?