Office 365 Activity log

Question

Hi

I have a user whose email account got compromised and I'm trying to piece together what has happened and whether there has been any privacy breach. Looking at the audit logs for the user I can see activity on her mailbox that says Updated Message as the Activity but what does this mean? I've searched for answers but haven't been able to find any. What I need to establish is whether I need to contact any person identified in the attachments to these messages and let them know of a potential breach or whether this was just the bad guy poking around.
There is the following in the Item field of the log record:
{
"Attachments": "imagejpeg_2016.jpg (222598b)",
"Id": "RgAAAACVyFhYdKU/RYCyWdlp05BJBwBsK2NpOrXqTpBQWh2Bi+G8AAAAAAEJAABsK2NpOrXqTpBQWh2Bi+G8AAEQIjadAAAJ",
"IsRecord": false,
"ParentFolder": {
"Id": "LgAAAACVyFhYdKU/RYCyWdlp05BJAQBsK2NpOrXqTpBQWh2Bi+G8AAAAAAEJAAAB",
"Path": "\Sent Items"
},
"Subject": ""
}

Grateful for any advice please.

Answer 1

For the situation now you are in, I will suggest you to open a service request. They will provide more in-depth investigation against those suspicious activities.