Why was this a 'hack'?
If, as AM is implying, this was an inside job by some kind of contract worker, and the data acquisition was possible by privileges and passwords, then it is not a hack. Depending on the non-disclosure wording and Canadian law it could even conceivably not be subject to espionage prosecution.