The exfiltration attempt would have likely been triggered on volume alone. Possibly it was simply a service that could not longer connect due to a lapsed cert trying to raise the alarm.