True. It can be part of a breach but is rare which is why the share is so small in the DBIR column. It is an incident type that gets a lot of hype despite rarely resulting in data exfiltration.