> and to likely sell to 3rd parties.

Can you provide literally any evidence that would suggest this is the case?

This sort of thing is common enough that simply establishing means, motive and opportunity are convincing to me. If not yet then soon. You can't hope for a smoking gun every time.

Give it a couple years for the inevitable data breach to leak all the details