Was that the one where due to political grand-standing, we had a government shutdown that led to furloughing the contractors who worked on security, so no one was watching the dashboard? Or was that a different one?
I’m not sure that breaches are prevented by “watching the dashboard”, but what do I know?
This feels like a lifetime ago, but IIRC evidence of on-going exfil was apparently presented to users who were no longer working.
Probably just one of the new recruits clicking on a link while viewing beastiality