← Customer 13160449

#37417 Locked

Resolved 2 Normal Created Mar 3, 2026, 10:46 AM Resolved Mar 10, 2026, 3:10 PM
System (internal) Mar 3, 2026, 10:46 AM 
Created from Lead: https://artichoke.shield.syncromsp.com/leads/40218619/convert
Check-in (internal) Mar 3, 2026, 10:46 AM 
Hey Peet,

It appears I’m locked out of my computer and can’t work. Please text or email me about what is happening. Thanks.

406-370-3373
[email protected]
Artichoke Support - Peet (internal) Mar 3, 2026, 3:06 PM 
Peter,

I’m sorry you were locked out of your account today. I locked your account yesterday out of an abundance of caution after Shea and Hannah brought to my attention that your account had deleted hundreds of folders and thousands of files in the SharePoint Docs “H” folder. When I investigated, there were signs of direct account compromise attempts against [email protected]. Coupled with the mass deletion, I was concerned there was an issue and a possible compromise.

After pulling a 72-hour audit log for your account and analyzing it, I was able to determine that the issue wasn’t a compromise. The attempted logins against your account from multiple countries are the result of earlier phishing attacks on your account that will likely remain active but cannot be successful without your current password/MFA being compromised. The hard part about the logging here was teasing apart your legitimate travel authentications and the failed “script kiddie” password attacks.

The actual issue that caused the alarm appears to be an accidental deletion of a synced DOCS “H” drive or synced “H” case folders from your OneDrive on your current laptop. When it was deleted, it caused more than 5,000 files across several hundred folders to be recycled. Coupled with your travel and the other activity, it was enough to trigger locking your account.

After ensuring your account wasn’t compromised and restoring the deletions after hours yesterday, I didn’t get your account unlocked. I’m sorry for any issues that may have caused. It’s unlocked now, and you should be good. If you would like any help double-checking any synced folders in OneDrive, I’m happy to help.

Hope you have a great trip.Peet
Ticket Automation (internal) Mar 10, 2026, 3:10 PM 
Automation AutoResolve-Waiting for Customer ran on this ticket. Actions: Change Status to Resolved