This is Hana from Atlas Freight. We noticed unfamiliar login activity from a new location and at least one user claims they never approved the session. Can someone investigate whether our workspace is compromised?
high-security-incident-4
Attachments
?
Customer incident note
Contains the customer's written timeline of the suspicious access and affected users.
Hi Hana, thanks for the detailed report. I reviewed the evidence for security incident report, and this should go to a specialist queue rather than being resolved in frontline support. I’ve summarized the evidence so the escalation starts with context.