It's as if these systems don't emit an audit stream, which when combined with the least bit of monitoring would have set off all sorts of red flags during these

It's as if these systems don't emit an audit stream, which when combined with the least bit of monitoring would have set off all sorts of red flags during these obviously anomalous events. Such negligence tends to make me wonder if it's to leave open the possibility of some easy insurance fraud. In this particular case, that seems to have backfired with supposed hackers arriving first, and the insurer sleazily wiggling out of their own obligations. At a past job, we ran thousands of shared linux servers for web hosting purposes. This was back in the early 2000s, and even then we had replaced all the installed shells with versions logging all interactive commands via UDP to a centralized syslog server. There was a simple IRC bot filtering the logs and echoing suspicious stuff into an IRC channel we monitored. Things like attempts to gain root, looking at /etc/passwd, lines starting with "./", running known irc bouncers or other script kiddie activities would be clearly visible and someone would intervene. That was just a web hosting company with a small team and quite limited resources. I expect better from these national financial service providers, this is just pathetic.