It sounds like they really did get hacked. Isn't the whole point of the lawsuit that they were too insecure with sensitive information, and therefore justifiable?
"Wallace said he tapped into LabMD's computers and pulled the medical records. The cybersecurity firm then alerted LabMD it had been hacked."
Well, Tiversa scanned LimeWire for PII and found a file containing billing records of patients on a PC belonging to LabMD. They copied the file and eventually gave it to the FTC, apparently claiming they found it on multiple computers on the LimeWire network.
"Wallace said he tapped into LabMD's computers and pulled the medical records. The cybersecurity firm then alerted LabMD it had been hacked."