Yes I think they mean they hadn’t seen it used before outside of sanctioned organizations. Though one could argue some bad actors inside the org likely used it outside of official capacity though not likely with knowledge or approval by superiors.

I don't buy it. To me, it'd be like hearing them say "we've never seen spam/scam phone call campaigns before!"

This loses all believability, given the fact that i can reliably go out of town to a different area code and immediately start getting phishing/scam/robo calls from numbers of said area code. Granted, i am U.S.'ian.

Wouldn't it be great if public officials would say what they in fact mean the first time?