And our data analyst was able backtrace it to an IP address.
A backtrace of the changes can be found in the/root/Bastille/undo directory.
