Client's Google drive may have been compromised, but nothing in the logs.

One of my clients' Google accounts is showing a mass data download (5k+ files) to an unknown IP, but it's connected to an internal user. My initial thoughts were that the account was compromised, but there are 0 suspicious authentications from that IP. The user also has Google Auth MFA turned on, but there are 0 auths from that IP. I started thinking it was a backup system, but the IP downloaded files belonging to other users using a single …

account accounts auth backup client clients compromised cybersecurity data download drive files google google accounts google drive internal logs may mfa system thinking thoughts