Shared service account svc-admin@acme-corp.com authenticated to prod-db-primary from IP 91.203.44.12 at 03:00 — a location with zero prior access history. The login was preceded by 4 failed 2FA attempts in 90 seconds. At 03:12, an elevated-privilege SELECT query ran against the customers table returning 14,200 rows — the largest single query in 6 months. The IP resolves to a residential VPN exit node in Eastern Europe. Confidence is 78%: 6 services share this credential, so the access could be from a new deployment runner. A forced password reset is the recommended action.