Was thinking about that. So one scenario, that depends on an API end-point for the internal tool, would immediately and quietly takeover and change account pass

Was thinking about that. So one scenario, that depends on an API end-point for the internal tool, would immediately and quietly takeover and change account passwords for targetted accounts. After that, start messages from individual accounts. While security is chasing around individual incidents it would take them a while to realize the breach is more systemic. That's probably when they threw the kill switch for verified accounts.