First, it's saying that the spike of activity started on 14th rather than that that's when it was detected or first acted upon. September 14th was a Friday. Due

First, it's saying that the spike of activity started on 14th rather than that that's when it was detected or first acted upon. September 14th was a Friday. Due to the weekend, it's unlikely anyone would have noticed before the 17th unless the anomaly was actually triggering production critical warnings. The pratical timeline was one week. Second, if the counters that were being triggered by the attack weren't obviously malicious, it's likely that for some amount of time it was treated as a lower priority figure out what's going on deal rather than a sign of something being critically wrong. "Hey, we're getting 25% increase in access to the video uploader but the number of successful uploads is normal. Did we break the page somehow and people are having to reload the page?". And then somebody spends a day looking at what was pushed the previous Thursday before deciding that the widget is working correctly and escalating to someone else. It's also highly likely that the product teams at Facebook (who would probably have started the investigation, since it was product-related counters going up rather than something obviously security-related) might not have sufficient access to logs to determine the exact sequence of events. Maybe they didn't have the raw IP addresses of the requests, so couldn't realize that all this increase in traffic was coming from a handful of systems. Maybe they could only see the requests to their own service, but not the full path of requests to other services that the attacker used to pivot from one vulnerability to another. A week after detection to deciding it was a security issue seems like a pretty plausible timeline to me.