Thanks for being so transparent.

Is it understood what the initial attack vector was? How confident are you that compromise is contained to just this GTM application (and lateral movement/exposure hasnt occurred)?

We identified and verified the attack vector and have no indication there is other compromise.

In addition to our in-house security team, we also have hired a 3rd-party firm to do their own investigation and validate our analysis.

We hope to share more about our findings once the investigation concludes.