INCIDENT REVIEW ALERT

Conflicting Login And File-Access Times

Identity login

08:14 UTC

VPN connection

03:12 local

File access

08:09Z

Initial theory

File accessed before login