Unless I misunderstand, this is software that runs on the target device. Does that count as distribution? Did the victims receive a copy of the license and access to the source code? Is there some kind of infringement case here if we could find someone this was used on?