The lack of records could complicate the identification of unauthorized access to customer networks during that two-week period.