The "agentic threat actor" may have used exposed credentials to access resources and delete cloud-based storage, applications, and databases.