IR team activated via PagerDuty - Affected workstation identified: WS-BILL-023 - Memory captured remotely using Velociraptor before network isolation - Network isolation implemented for the billing VLAN - Management and legal notified