Yeah, I'm fairly sure one of the first news pieces on the attack literally said the security team discovered the breach when "alerted by suspicious activity on

Yeah, I'm fairly sure one of the first news pieces on the attack literally said the security team discovered the breach when "alerted by suspicious activity on their customer database" - sounds a lot like an IDS functionality.