Seems like our metabase instance got hacked by this. They got some credentials that are mostly useless outside of our network environment, but we pretty quickly rotated everything. Getting claude to do forensics on the attack was really good, it pieced together the whole timeline and what was done.