Ticket summary
On 25 March 2026 FastCart's data engineering team opened IR-2026-0325-026 after historical records in fastcart-order-archive began returning 404/NoSuchKey. Application triage found no faulty delete path. CloudTrail instead shows versioning being suspended immediately before a burst of object deletion by fastcart-webhook-exec-role—the same role involved in IR-2026-0321-021. No ransom note or extortion demand was found.
Four days earlier, IR-2026-0321-021 established that a malicious webhook invocation gained code execution in fastcart-order-webhook, used its execution role to read the order archive and payment-provider secret, and successfully published unapproved function version 43. The earlier ticket closed without removing that version or revoking the role's active sessions.
The supplied evidence shows normal archive reads, a policy change made through a deployment-role session originating from the persisted function, a fresh fastcart-webhook-exec-role session, a PutBucketVersioning request, and the deletion burst. Determine the scope and sequence without assuming every missing current key is permanently lost.
S3 versioning semantics are central. A delete in a versioning-suspended bucket removes a null version if one exists, but a named version created while versioning was Enabled remains as a noncurrent version behind a delete marker. Use the object-version inventory and timestamps to separate recoverable named versions from permanently removed null versions.