Experienced this with a client as well, all my thoughts to you guys and the team. One thing we struggled with was determining the effective blast radius of compromised credentials. Blocking access was one thing, but the other critical component was whether activity could be reconstructed from independent logs (for this event and in future). Intereseted in whether the postmortem covers how you guys have established those boundaries, would make for some good learnings in general.

Feels like a new normal