Back to Cases
VIG-2026-1098·
Credential Stuffing – 47 Accounts Breached
CRITICALResolvedAI: 97% confidenceAt Risk: $234,000
Case Description
Isolation forest detected 47 accounts accessed from same botnet IP range in 3 hours. Deep autoencoder reconstruction error exceeded threshold by 400%.
#ATO#credential-stuffing#botnet
Risk Score96%
Assigned Team
Analyst
Flagged ByIsolation Forest Engine
Created6/11/2026, 10:15:00 PM
Subject
Customer Segment: 65+ Age Group, Branch 04
Industry
Banking
Amount at Risk
$234,000 USD
Escalation Level
L1 — L1 Analyst
TO
Thomas OkoroStatus Changed
Status changed: OPEN → INVESTIGATING.
SO
Sarah OkonkwoAnalyst Assigned· Banking Fraud Team
Assigned to Thomas Okoro for investigation.
SO
Sarah OkonkwoTeam Assigned· Banking Fraud Team
Assigned to Banking Fraud Team.
PN
Priya NairAlert Escalated
Alert escalated to case. Risk score 89.
AH
Ahmad HassanCase Created
Case automatically created by AI rule engine.
Evidence Locker
4 itemsBulk ATO Pattern
47 accounts. 3 IPs. 3 hours.
Confirmed
Mitigation Triggered
All sessions terminated. MFA enforced.
Confirmed
SWIFT Transaction Log
MT103 raw transaction data export
Confirmed
GNN Entity Graph Export
Graph node-edge export — linked entities
Confirmed
Event Timeline
Bulk ATO Pattern
47 accounts. 3 IPs. 3 hours.
10:15:00 PM·Isolation Forest
Mitigation Triggered
All sessions terminated. MFA enforced.
10:17:00 PM·AI Mitigation Engine