This is Rina from Beacon Health. We noticed unfamiliar login activity from a new location and at least one user claims they never approved the session. Can someone investigate whether our workspace is compromised?
high-security-incident-2
Attachments
?
Customer incident note
Contains the customer's written timeline of the suspicious access and affected users.
Hi Rina, thanks for the detailed report. I reviewed the evidence for security incident report, and this should go to a specialist queue rather than being resolved in frontline support. I’ve summarized the evidence so the escalation starts with context.