As the team continued to investigate, they discovered that the attacker had been using the compromised endpoints to exfiltrate sensitive data, including intellectual property and employee information. The breach had been ongoing for weeks, and the company was now facing a potentially catastrophic situation.