The bad actor overrode security measures and remotely accessed workstations and “certain unclassified documents” from users.