Claims
Lateral movement occurred from the compromised principal into other production services.
unsupportedobservedv1
The access originated from an internal corporate IP, not an external actor.
contradictedinferredv1
Customer PII was exfiltrated in bulk from the bucket to an external host.
partialhypothesisv1
The credential was leaked through CI build logs for job deploy-4821.
supportedinferredv1
The leaked CI credential AKIA-CI was used from Tor exit node 185.220.101.5 to read the prod-customer-data bucket.
supportedobservedv1
Coverage
cloudtrailcomplete
2 eventss3-access-logpartial
1 eventvpc-flow-logabsent
0 eventsguarddutycomplete
1 eventCoverage gaps
criticalMISSING_SOURCE · vpc-flow-log
materialPARTIAL_SOURCE · s3-access-log