If they were logging access logs, the logs may have not shown what was accessed specifically in a program. Just ip addresses connecting to machine/software but

If they were logging access logs, the logs may have not shown what was accessed specifically in a program. Just ip addresses connecting to machine/software but no request disclosure. They have reasonable suspicion to be overly cautious: "After delving into the anomaly we found a similar but smaller matching traffic anomaly from one of our databases in the opposite direction (more traffic was sent from the database compared to what was received on the server)." I hope they explain how they are going to resolve this for the future.