# Breach Re-Check — megan.hiatt@cascadestucson.com

**Date:** 2026-06-30 · **Performed by:** Howard Enos (ClaudeTools session)
**Tenant:** Cascades of Tucson (cascadestucson.com, `207fa277-e9d8-4eb7-ada1-1064d2221498`)
**Object ID:** `ab306d53-6d6c-4f8f-a982-f4f571722178`
**Why:** Megan's account carried a `CREDENTIAL_STUFFING_ACTIVE` marker in the April tenant
inventory. This re-check verifies whether the April remediation held and whether the campaign is
still active. Read-only; no actions taken.

## Verdict — CLEAN. April remediation held; attack no longer active.

The April credential-stuffing campaign (119 malicious sign-in attempts over 30 days from 7
EU/UK IPs, all blocked at error 50053) has **ceased**, and the hardening applied in April is
**still in place**. No compromise indicators.

## April remediation — current status (did it hold?)

| April control | Current state (2026-06-30) | Held? |
|---|---|---|
| Disable SMTP AUTH on Megan's mailbox | `SmtpClientAuthenticationDisabled=true` | **Yes** |
| Disable IMAP | `ImapEnabled=false` | **Yes** |
| Disable POP | `PopEnabled=false` | **Yes** |
| Rotate password | Last change `2026-05-28` (post-April; rotated) | **Yes** |
| MFA = Authenticator (not SMS) | Methods: password + microsoftAuthenticator only; **no SMS**, no new method | **Yes** |
| Tenant anti-spam / anti-phish hardening (SPF hard-fail, mailbox-intelligence quarantine, first-contact tips) | Applied tenant-wide in April (Default policies) | (tenant-level, unchanged) |

EWS / ActiveSync / OWA / MAPI remain enabled — same as April; those are modern-auth capable, not
basic-auth bypass paths.

## Live breach check (10-point) — all clean

| # | Check | Result |
|---|---|---|
| Sign-ins (30d) | **0 interactive, 0 non-US** (was 119 malicious + 16 US-success in April) | No active attack; no foreign success ever |
| Account | `accountEnabled=true`, cloud-only | normal |
| Auth methods | password + Microsoft Authenticator (2) | no new/weak method |
| Inbox rules | 1 visible + 4 hidden — all benign (Junk default, 2 OOF system, user "Cascade of Tucson" move rule) | no forward/redirect/delete |
| Mailbox permissions | 0 non-SELF | no delegates |
| SendAs | 0 non-SELF | none |
| Forwarding | `ForwardingAddress=null`, `ForwardingSmtpAddress=null` | not forwarding |
| OAuth grants | 5 — Outlook Mobile ×2, third-party OIDC SSO, Contacts.Read (April set) **+ ALIS SSO SP `e1cae4ad…` User.Read** (expected, June 3 ALIS rollout) | benign |
| Directory audits (30d) | 0 | no admin tampering |
| Risk detections | 0 (risky-user read still `Forbidden` — known `IdentityRiskyUser.Read.All` consent gap, not a finding) | — |

## Notes

- **`CREDENTIAL_STUFFING_ACTIVE` is a stale April marker**, not a live signal — the campaign is no
  longer hitting (0 attempts in 30d). It reflects April state captured in the tenant inventory.
- The only April recommendation not confirmed implemented is **C1 — Conditional Access US-only
  geo-block** for office users. It is now **optional/low-urgency**: every stuffing attempt was
  already blocked by MFA + MS IP-reputation, and the campaign has stopped. Worth scheduling as
  baseline hardening but not an active risk.
- Raw artifacts: `/tmp/remediation-tool/207fa277-…/user-breach/megan_hiatt_cascadestucson_com/`.