Unauthorized access to support archive

On 24 September, an external actor accessed a support export containing customer correspondence.

What happened

The actor used credentials belonging to Leah Morgan (leah.morgan@atlas.example). The credentials were recovered from the employee's personal cloud drive.

Data involved

The archive contained customer names, email addresses, partial payment details, support attachments, and authentication reset links. Affected account identifiers are attached to this report.

Investigation

Forensic evidence, internal IP addresses, detection rules, and the active law-enforcement contact are included in Appendix A.