Security analyst, still learning. I ask a lot of questions, sorry in advance.
It was a backup job. Failing since March. Nobody noticed because the alert email goes to a distribution list everyone filtered.
12 right now, maybe 20 by end of year. Mostly web servers and 2 DCs.