my company got breached
the attacker had access for 11 days
on day 3 he emailed our IT helpdesk
complained that the VPN was slow
our helpdesk reset his password
upgraded his access tier to fix the "connectivity issue"
and closed the ticket as resolved
CSAT score: 5 stars
we found this in the logs during forensics
the attacker had rated our IT support
excellent