The first step was to review the system logs and identify any suspicious activity. CP and her team worked tirelessly, filtering through lines of code and data, searching for clues.