Human · Investigation

CASE-002

Investigating

Naliaka Chepkoech was dormant for 170 days, then acted · Jua Kali Artisans Kwale SACCO · opened 17 Aug 2026, 15:10 GMT+3 by Risk & Compliance Team

Naliaka Chepkoech was dormant for 170 days, then acted
Behaviourhigh severity
Priority
85
Rule fired · behaviour.dormant_admin_burst

Naliaka Chepkoech (super_admin) had no login activity for 170 days, then performed 4 privileged actions within 24 hours of logging back in.

  • login:login-coop-21-scenario-60 — Last login before the dormant gap
  • login:login-coop-21-scenario-61 — Login that ended the dormant gap
  • privileged_action:act-coop-21-scenario-0 — grant_role
  • privileged_action:act-coop-21-scenario-1 — reset_mfa
  • privileged_action:act-coop-21-scenario-2 — view_report
  • privileged_action:act-coop-21-scenario-3 — grant_role
AI assessment

A super_admin account inactive for 170 days suddenly performed 4 privileged actions within 24 hours, including granting roles and resetting MFA, which is highly indicative of possible account compromise or misuse. This warrants urgent review given the elevated access level and the sensitivity of the actions.

View this finding in context on Jua Kali Artisans Kwale SACCO →

Reports 0 reports

No reports yet. Press New Report to start one from a template — or from a blank page — and generate a versioned PDF when it is ready.

Discussion 0 comments

No comments yet — add the first note for the investigation record.

Case actions

Activity timeline

  1. Status change · 17 Aug 2026, 15:10 GMT+3

    Status changed from open to investigating

    Risk & Compliance Team
  2. Case opened · 17 Aug 2026, 15:10 GMT+3

    Case opened on escalation

    Risk & Compliance Team