Since the data seems to have been stolen around the time MtGox shutdown or later the question would be ... why would you keep this information on a webserver if you aren't actively using it anymore?
Is there data that suggest this? I'm not yet on a machine with an environment I can open it, so I'm only going off the reports of the last few months missing from the CSV. or is that just based on when the rumors of this started. Until I see data that proves the hack happened after the shutdown I'm going to assume they don't have it because it happened before or only involved a backup.
I mean, at this point it wouldn't surprise me in the least if Mark still had it facing the web, but I'm not about to trust the word of the hackers without evidence.
EDIT: Ah,
user end balances are supposedly correct, that would be evidence supporting the word of the hackers.